vtiger CRM prior to 5.0.3 allows remote authenticated users to import and export the information for a contact even when they only have the View permission.
vtiger vtiger crm