Kallithea prior to 0.3.2 allows remote authenticated users to edit or delete open pull requests or delete comments by leveraging read access.
kallithea kallithea 0.3.1