Attachment Permissions Not Followed
Not sure if perhaps this should be a private issue, since it's hard to pull off, but it doesn't really cause any "security" issues -- a user that is able to edit some articles, is able to remove attachments from articles he/she can't edit (due to it being protected, moderated, etc). The user still can't edit the text or add new attachments, but removing existing attachments is completely feasible (I'll leave out how, although it may be easy to figure out). Again this is only possible if the user is able to edit other articles anyway.
Fixed for the next build.