{"action":"Upgrade sopel-plugins-channelmgnt to 1.0.3 or later.","affected":[{"fixed":"1.0.3","introduced":"0"}],"component":"sopel-plugins-channelmgnt","cve_ids":["CVE-2020-15251"],"ecosystem":"PyPI","epss":0.01454,"exploited":false,"fixed_versions":["1.0.3"],"ghsa_id":"GHSA-23pc-4339-95vg","id":"tcs_01M5KG9BG6C9B47SZK8QKAJGV2","modified_at":"2023-11-08T04:02:35.589540Z","published_at":"2020-10-13T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-110","https://pypi.org/project/sopel-plugins.channelmgnt/","https://phab.bots.miraheze.wiki/T117","https://github.com/MirahezeBots/sopel-channelmgnt/pull/3","https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-j257-jfvv-h3x5","https://github.com/MirahezeBots/MirahezeBots/security/advisories/GHSA-23pc-4339-95vg","https://phab.bots.miraheze.wiki/phame/live/1/post/1/summary/"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-110","url":"https://osv.dev/vulnerability/PYSEC-2020-110"}],"summary":"In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled"}