Bukkit

kinda a niche issue

we have a plugin Geyser that translates Bedrock to Java, so bedrock players can join our server
Floodgate handles authentication
there's a issue where bedrock users are able to take items from the MyCmd GUI's by swapping them with another item.
tried it with B~ and B. added to the start of usernames (mycmd dislikes B~)

made a test server to narrow things down as best i can, if you need more details or access to anything i can help you out with that

Server: Paper and spigot (effected multiple paper versions, tried newest spigot)
Bungeecord: Travertine (version 191 which is current, effected on multiple versions)
Geyser: Geyser 745 (effected multiple versions)

**plugins:**
ViaVersion
ViaBackwards
FloodGate
MyCommand

**BungeeCord Plugins:**
Geyser-BungeeCord
FloodGate-Bugeegee
ServerListMotd

i did it on mobile (effects consoles 2)
open a GUI in mycommand
tap an item so its highlighted
tap a 2nd item and it will throw one out of your inventory
get items from GUI from ground