In survival, you can use a piston block to push TNT or glowstone into your head, then go in third person and you can Xray without taking damage.
This bug still definitely happens in 1.13+ Why is it marked as resolved?
This problem was fixed in the 1.8.0.10 Beta, however, it seems to have returned in 1.8.1. I was hosting a game in Survival, and all other players had all the basic permissions except attack players (nobody had operator), and one of the players was able to change their game mode to creative (or some hybrid of survival and creative)
Not from the Marketplace, custom packs, however this seems to fixed in 1.8.1
This still does not seem to be fixed, even though it is marked as resolved. Can we have an example of a datapack which uses this feature correctly?