Why is someone with a role that has just browse permission able to move tasks

[Tim Bachta]

I have a read only role created where the only permission for this role is to Browse Projects. I logged in as this user and everything looks fine until I go to the Work part of the agile board, I am able to drag tasks around within the sprint. When I try to do a simmilar action of draging the storys in the planning area i get the right result, a insufficent permissions error.

[Norman Abramovitz]

If you think this is a bug (it probably is) then report it to atlassian support. You can search their support site to see if this issue has been reported already as well.