ideally, the system would be ok.
Scenario: I may allow upload for anyone, so i can let them put files with a special form, then i can access myself (and only me) that folder, to see the uploaded files. It may, in this sense, be considered a feature.
Realistically, most people wouldn't expect such behaviour (usabilty flaw), thus it could result in a security issue.
I will change the behaviour from next build, and "access" rights will be checked on an upload, not only "upload" rights.
