Any player with custom permissions can "change" their game mode and permissions.

I was unable to reproduce this bug personally, but I may be missing a step. If (after testing again) you are able to add steps to reproduce the bug it would be helpful.

Ok? Well I'm not exactly sure what you mean by "reproducing" the bug. This bug seems to always be active (other than giving a player one or more privelage with cheats enabled). But yes, I will try to find another step, but I imagine it to be very hard to find since I have already tried altering most of the settings that made sense. It also seems only a select few have somehow triggered this bug (I have only found one person, that I have yet to find again. I have also tried changing my game mode in a someone's world that had given me privelages and had cheats enabled, to only fail. Finding out that this bug was triggered by me surprises me lol. So, if you have any advice to reproducing this bug I haven't already tried yet would really help because I am at a loss. I'll go try some things. Thanks so much! 🙂

We've tested this further and think we've come up with a way to reproduce the problem, this can be tested on yourself or another player:

Steps to Reproduce:

1. Launch Minecraft.

2. Create a new World in Survival Mode with active cheats.

3. Open Pause Menu and proceed to Player Permissions.

4. Set your Permission Level to Custom and set Operator option to 'Yes'.

5. Go back to Pause Menu.

6. Proceed to Settings and set Personal Game Mode to Creative.

7. Open Creative Menu and attempt to pick any Block from it.

8. Fly up using Creative Flight then cancel flight to fall to the ground.

Observed Results:
The player is in a semi-creative gamemode. eg, can't remove items from creative inventory. Player can fly, but can also take fall damage.  Also, changing the player's gamemode to survival doesn't appear to work correctly until they relog.

Expected Results:
The gamemode should apply correctly.

I've tested this out and it worked! This is the exact same bug I have been experiencing (only difference is I don't give the players' Operator). Thank you so much for finding this out. I tried but couldn't figure it out (sorry). The only question I have now is: can I fix this on my own or will it have to be reported and fixed?

I have experienced the same bug. I would like to add a few things.

I logged in a seccond player to see it on their screen, and how it works. What happened
I set the player to custom permissions, with ONLY attack players, and doors and switches..
they were not an operator or anything, just custom with those two permissions

What they did to get into creative, was go into SETTINGS, under game, where it shows the difficulty, their gamemode, default gamemode, and so on... For some reason, they were able to change their private gamemode and the default gamemode in settings. I dont think they were able to use the command /gamemode c, but they could change the settings.

When i first saw this, i suddenly freaked out and threw the player in a prision cell for fly hacking, which he pleaded was not hacks, but just settings.

I'm not sure if it was intentional for you to make it so players with custom permissions are able to change their gamemode in settings, but even if it was on purpose, it causes lots of problems, and should be changed.

especially on realms, everybody wants me to make a PvP mini game, but with privileges so limited, I cannot.

I was on the new Minecraft when i experienced this, on the nintendo switch console . this was a normal world, but knowing player permissions were going to be re-added to realms, I want to make sure this bug doesn't come with it!

Hello OddDuck, it's me, Fate.

I had no idea you had this issue! I tried the same thing as you (adding in a second player and seeing what the problem was). And yes, I believe they can only change game modes through Settings.

I can also confirm is NOT intentional, and needs to be fixed immediately.

OH, and Mega Spud's reproduction method of the bug has been fixed with the new update, yet not the one we are having trouble with.

I find it sad I have not been playing Minecraft very much lately due to this malicious bug. Please, fix this! 😢

I think the title of this report may be a tad bit off...
"It shouldn't be all players on all my worlds have operator status"
but rather
"all players with custom permissions, but NOT OP, are still able to change their game mode in settings."

This is a bug tracker, not a chat board. Please limit comments to providing new information about the bug.

The affected version 1.4.1 should have been updated on all Switch devices by now. Would one of you please confirm which version(s) you are using now?

Also, if the reproduction steps above no longer produce the bug, can you suggest modifications to it that will?

I'm on the new version

Apologies. I am currently on version 1.5.0, the bug is still present in my experience. I have no suggestions to reproducing the bug, all I can say is when I give a player one or more privilege (making them custom) they have the option to change their game mode and default game mode through settings.

Good information, thank you. Let me ask you to clarify something. The default for Trust Player Permissions is Member, which includes everything but Operator and Teleport permissions. So if you left the default, the only permission other than operator that you could add would be Teleport. But adding Teleport forces Operator on, so I wouldn't think that's what you did. Am I right to conclude that your Trust Player Permissions is set to Visitor, and you're giving limited (less than Member) permissions to your guests? Is there a specific combination of permissions you give? It might help us to reproduce the problem.

You're right, that's not what I did. Yes, my Trust Player Permissions are set to Visitor, and all I add is can "Use doors and switches," "Open containers," "Attack players," and "Attack mobs." I have also tested and discovered that if I give any privilege (other than Operator or Teleport of course) the bug is triggered.

I was only giving doors and switches and attack players, and they were able to change their game-mode.
I will double check if this is still a problem

It's apparently still a problem to some extent, because I can very easily create a situation in which a LAN Survival player with any combination of Custom permissions can, by performing a certain sequence of steps, unlock all world settings and permissions and give themselves Operator. However, it's an illusion. The enhanced permissions are seen only by the client; to the server and other players, their permissions haven't changed. And what the server thinks their permissions are is all that matters in the end, because the server always wins if they don't agree. To get true Operator permissions, the client would somehow have to trick the server into favoring the client's opinion over its own.

How it could do that is what I can't figure out. Maybe if a previous crash caused a possibly unreliable save, the server asks the clients to report what state they believed they were in? I could see that being preferable to just deleting the world if you can't be sure it was saved correctly. But this is pure speculation, and I probably shouldn't speculate.

Just for the record, Could somebody please verify that someone who incorrectly has Operator permissions really can perform operator command and settings? For instance, can they change another player's permissions and actually change what they're able to do? Or if they set the difficulty to Peaceful, do mobs actually stop spawning? In what's been said so far, I haven't seen any clear proof that they actually are Operators, as opposed to having tricked their client into thinking they are.

To be clear, the title of this issue is misleading (I have no idea how to edit the title since I'm on a mobile device, sorry). I have also made it clear in my report that this bug is present in EVERY world I create. The players' do not have Operator, but they CAN edit other players' privileges, including my own, and can ONLY change default game mode, as well as their own.

I think I was unclear. In my experiments, a player with Custom permissions is able to set the Default Game Mode to enable all the other controls I wrote about, and after that they could set all of those controls, including the world options and permissions for everybody. They could do this even if they didn't give themselves Operator status. So this sounds like what you're saying.

However, in my experiment, changing these settings only appeared to have effect, and only on their device. Other players did not see their changes, and if they left and rejoined the world all the settings went back to the way they were. This sounds different from what you're saying, and right now I can't explain that. Since our observations are otherwise so similar, I was looking for confirmation that their changes actually affected all players, and that you (as the host) could see the changes they made to permissions, to ensure it wasn't just a case of them telling you they were able to make changes and you assuming that those changes actually took effect when, as in my experiments, in reality they didn't.

There is definitely a bug here in that non-Operators with Custom permissions are able to use the Default Game Mode setting. Although they can't in fact change it, just the act of trying to then makes all the other settings and permissions available to them. If the Default Game Mode control were disabled for them, as I believe it should be, they wouldn't be able to change any settings or permissions at all.

If they actually can take control of the game, unlike in my experiments, it's possible there's another step I'm missing that allows that to happen. I'll keep trying to reproduce it reliably.

Yes, my issue is different in a way, but still similar. I know this is not an illusion because I tested it by using a second controller to join my world and giving the second player custom permissions, which activated the bug. I can also confirm other players' can see the changes, as well as myself. Players' can, in fact, affect other players' when altering the default game mode.

Great! I think we're closing in on this bug, finally. Stay tuned.

Thank you so much. I appreciate your patience and help!

I would just like to put this out there. You were right Auldrick, sorry.

When and if a player has custom permissions, they have the ability hover over and click on all World Options and Cheats, though they can't be changed.

Only then (having custom permissions) do players' have the ability to change their and others permissions/privileges.

Players' who forced their way into Creative CAN take fall damage, and CAN be hurt and killed by mobs or other players.

Players' CAN NOT take items from their Creative menu. Once the item is clicked it flashes into the inventory and disappears immediately.

If a player who forced their way into Creative gives themselves the Build and mine permission, they CAN NOT break or place ANY block. Players' that have given themselves the Open containers permission CAN NOT open ANY container (including Command blocks even if they have given themselves Operator). Players' that have given themselves the Attack mobs permission CAN NOT attack ANY mob. Players' that have given themselves the Attack players permission CAN NOT attack ANY player. Players' that have given themselves the Operator permission CAN NOT use commands in chat (including Teleport). Players' that have given themselves the Use doors and switches permission CAN NOT use ANY door or switch. THE ONLY EXCEPTION is if an Operator gives them a permission it WILL WORK. Players' who have given themselves permissions is not visible to an Operator when an Operator clicks on their permission list.

I apologize Auldrick for not looking into this more. I wasn't completely sure what you meant by an "illusion" at first, but now I do. It IS an illusion, and the only way to tell they are in "Creative" is when they fly...

Again, I'm sorry and you probably already knew all of this already. Thank you so much!

I appreciate your honesty despite what might have been an embarrassing admission. There's nothing to apologize for, though: we all take shortcuts sometimes. Thank you for re-testing and reporting so thoroughly, too. It's strong evidence that we now have this bug surrounded on all sides. That will save the developers a lot of extra work, which means they should be able to fix it much faster. I will update the description above to be more accurate.

I'm assuming that nobody else who's commented here is still convinced that other players can actually give themselves the ability to perform operator-only functions (other than changing settings that don't actually change anything). If anybody still is, after reading the recent comments above, please comment again.

I have been on for the past couple of days and this is the only work around I have found at the time.

If a player is in Survival with custom permissions and can "change" their game mode and permissions; setting the player's game mode to Adventure will block them from using this ability.

Since you can't change the default game mode of your world to Adventure, you can put a command block at the spawn of your world set as /gamemode 2 @p that will activate everytime a player spawns.

This is actually quite useful since you can't break anything in Adventure, even with the can build and mine permission.

I have a quick question about adventure mode. Kase, before, players were able to break some blocks, like glass or string. Are they still able to if they are in Adventure mode, or did they change it so nothing can be broken?

They changed it to where nothing can be broken in Adventure mode, even if you have the appropriate tool to break the block.

@unknown: Please stop repeatedly updating tickets. You are causing a flood of notification emails to everybody watching them. The text entry forms have a "Visual" tab at the bottom that you can switch to to review what you've entered before submitting.

(Also, the changes you've been making to the description and summary only seem to be repeating what I already added there, so your updates don't seem to serve a purpose. The developers are already looking into this problem and aren't likely to notice your changes, since they work mostly from a separate system.)