Logged in user can change permissions on a plan but doesn't have right for it

Problem found on: https://gdansk.bamboo2.atlassian.com

1. Log in to: https://gdansk.bamboo2.atlassian.com
2. Goto: https://gdansk.bamboo2.atlassian.com/chain/admin/config/editChainPermissions.action?buildKey=ACC-DPL&saved=true
3. Logged in user is not on a Admin list but can change any permission.
(for example can change add Logged in users to Admin rights permission and click save)

See attached screenshoot