CVE-2020-15251

In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2 includes 1.0.3 of channelmgnt, and thus is safe from this vulnerability. See referenced GHSA-23pc-4339-95vg.

• CWE-863
• CWE-862

• https://github.com/MirahezeBots/MirahezeBots/security/advisories/GHSA-23pc-4339-95vgThird Party Advisory
• https://github.com/MirahezeBots/sopel-channelmgnt/pull/3Patch, Third Party Advisory
• https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-j257-jfvv-h3x5Third Party Advisory
• https://phab.bots.miraheze.wiki/T117Broken Link
• https://phab.bots.miraheze.wiki/phame/live/1/post/1/summary/Broken Link, Vendor Advisory
• https://pypi.org/project/sopel-plugins.channelmgnt/Product, Third Party Advisory
• https://github.com/MirahezeBots/MirahezeBots/security/advisories/GHSA-23pc-4339-95vgThird Party Advisory
• https://github.com/MirahezeBots/sopel-channelmgnt/pull/3Patch, Third Party Advisory
• https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-j257-jfvv-h3x5Third Party Advisory
• https://phab.bots.miraheze.wiki/T117Broken Link
• https://phab.bots.miraheze.wiki/phame/live/1/post/1/summary/Broken Link, Vendor Advisory
• https://pypi.org/project/sopel-plugins.channelmgnt/Product, Third Party Advisory

Published

Oct 13, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15246October is a free, open-source, self-hosted CMS platform bas…7.5
• CVE-2020-15247October is a free, open-source, self-hosted CMS platform bas…5.2
• CVE-2020-15248October is a free, open-source, self-hosted CMS platform bas…4.2
• CVE-2020-15249October is a free, open-source, self-hosted CMS platform bas…5.4
• CVE-2020-1525A memory corruption vulnerability exists when Windows Media …7.8
• CVE-2020-15250In JUnit4 from version 4.7 and before 4.13.1, the test rule …5.5
• CVE-2020-15252In XWiki before version 12.5 and 11.10.6, any user with SCRI…8.8
• CVE-2020-15253Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scri…4.8
• CVE-2020-15254Crossbeam is a set of tools for concurrent programming. In c…9.8
• CVE-2020-15255In Anuko Time Tracker before verion 1.19.23.5325, due to not…7.3
• CVE-2020-15256A prototype pollution vulnerability has been found in `objec…9.8
• CVE-2020-15257containerd is an industry-standard container runtime and is …5.2