The vulnerability in PocketMine-MP allows operator names that contain non‑lowercase letters to remain in the operator list even after an operator attempts to revoke them with the deop command. Because the removal logic lowercases the supplied name but then requires an exact match, the operator entry is not removed. This flaw results in a persistence of operator privileges, enabling the affected user to continue exercising administrative control on the server. The weakness is classified as Improper Case Handling (CWE-178).

All versions of PocketMine-MP older than 4.0.3 are affected.

The CVSS score is 4.8, indicating a moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. An attacker who can issue the deop command—typically a local or remote operator—can exploit this flaw to ensure they remain in the operator list after attempting revocation, thereby maintaining administrative authority. The exploit requires the ability to execute deop commands on the server; no additional privileges or conditions are stated.