Gamemode Change Hack? [UPDATE: Force Gamemode Not Working]

I recently started up a sponge/forge survival/economy server after migrating from Bukkit and somehow a couple players manged to change their gamemode to creative and I’m very confused as to how this was possible.

I confirmed that they did not gain access to either OP or admin permissions and the server config is set up to automatically default all player’s gamemode to survival upon login even for OPs and admins. I also double checked my default permissions and there’s nothing that would allow them to do this.

Is there some sort of gamemode exploit that currently exists in sponge/forge, or hacks available to do this because afaik none exist so this shouldn’t of been possible. The only thing I can figure is they were able to exploit one of my plugins…? Any insight would be appreciated. Thanks.

Also I’m running a Sponge 1.11.2 server.

Do you use the perm?

LuckPerms Plugin.

Are you using an essentials plugin such as Nucleus?

Yes, I’m also using nucleus.

Do you still have access to the logs around the time it happened? They may provide some information on how it happened.

Unfortunately no… I wasn’t thinking and reloaded the server after I banned them and lost the logs, but while it was going on I was taking a look through console and in my logs, but didn’t see anything that stood out to me.

They all had default permissions which doesn’t enable them to change their gamemode and it’s impossible for them to get OP since you need access to console. They also tried to break my block protections, but couldn’t. They were only able to do damage outside of spawn.

At first they were just flying which I assumed was just a fly hack until they started laying down tnt that they didn’t obtain legitimately. When I switched them back to survival mode and they fell out of the air, so it wasn’t a fly hack they were using it was creative mode.

FWIW, I checked /gamemode in Nucleus with default permissions, it’s blocking it correctly. I was worried I had a major issue there…

Sorry, probably doesn’t help, but I did want to make sure of it on that end!

It happened again. It seems everyone is logging in originally with creative although default gamemode is set to survival. They’re all spawning themselves blocks of diamond… lol.

Latest log file attached (I saved the logs this time).

All I can figure is that… the map I’m using for my sever was created in creative mode and sponge seems to be defaulting players to that rather than what’s in the file?? which is set to force survival mode.

The odd thing is force gamemode is working for me and I’m OP. This problem seems to be only effecting the original login, but I’d have to confirm. I have the fml-server log available (see download link it was too large for pastebin).

Any help correcting this would be appreciated. This is basically making my server unusable at the moment…