Permission seeingui let user wear cosmetics even if they don't have the wear permission #346

Terms

• I'm using the very latest version of CosmeticsCore and its dependencies.
• I already searched on this Github page to check if the same issue was already reported.
• I already searched on the plugin wiki to know if a solution is already known.
• I already searched on the Discord server to know if anyone already provided a solution in the past for the issue.

Discord tag (optional)

ouafax

What happened?

When I give the player the permission cosmeticscore.user.cosmetics.seeingui.* or cosmeticscore.user.cosmetics.seeingui.ANY_COSMETIC_NAME they can see every or the specified cosmetics in their /cosmetics command. The problem is that even with cosmeticscore.user.cosmetics.wear.* set to false (so it should only allow them to see them as Locked in their inventory) they can still wear them.

Steps to reproduce the issue

1. Using any permission plugin (like luckperms) set the wear.* permission to false
2. Using any permission plugin (like luckperms) set the seeingui.* permission to true

In that setup, you can see every cosmetics and wear them.
It wont save but you can still wear them in the current session.

Server version

This server is running Paper version 1.21.8-6-main@782ce95 (2025-07-18T20:26:58Z) (Implementing API version 1.21.8-R0.1-SNAPSHOT)
You are 54 version(s) behind
Download the new version at: https://papermc.io/downloads/paper
Previous version: 1.21.7-32-e792779 (MC: 1.21.7)

CosmeticsCore Version

CosmeticsCore version 1.3.8

ProtocolLib Version

ProtocolLib version: 5.4.0

FULL server log

No response

Error (optional)

CosmeticsCore config.yml

Problematic items yml configuration file (optional)

Other files, you can drag and drop them here to upload. (optional)

No response

Screenshots/Videos (you can drag and drop files or paste links)