CyberRota Analysis
AI-GeneratedThe vulnerability affects PocketMine-MP versions prior to 4.0.3, where the removeOp function fails to perform case-insensitive matching when revoking operator entries from ops.txt. This oversight allows operators with names stored in non-lowercase letters to retain their privileges, potentially leading to unauthorized access if not manually corrected. Server administrators using affected versions should prioritize this update to mitigate the risk of privilege escalation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop command, leaving the player as an operator until the entry is removed from ops.txt manually.