CVE-2021-48006

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop...

CVE-2021-48006

PocketMine-MP versions before 4.0.3 contain a case-sensitivity flaw in the removeOp function. When the deop command is issued, the function lowercases the supplied operator name but then performs an exact-match removal from ops.txt . As a result, any operator whose name was stored with uppercase ...

EUVD-2021-34876

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop...

GHSA-J5QG-W9JG-3WG3 Inability to de-op players if listed in ops.txt with non-lowercase letters

Impact Originally reported in iTXTech/Genisys1188 txt PotterHarry98 potterharry98 deop PotterHarry98 will remove potterharry98 from the ops.txt but not PotterHarry98. Operator permissions are checked using Config-exists with lowercase=true, which will result in a match:...