Draft retrieval in the editor doesn't respect page or space permissions

Drafts are supposed to be per user and private but given a draft id, which should be easy to guess as they are sequential, you can access the contents of any draft, both for new and existing pages by using the following urls:

https://pug.jira.com/wiki/pages/createpage.action?useDraft=true&spaceKey=SPACE&draftId=target

https://pug.jira.com/wiki/pages/editpage.action?useDraft=true&spaceKey=SPACE&pageId=anyPageWithAccess&draftId=target

It seems that anonymous users cannot take advantage of this though, as drafts for them are queried in the session and not in the database.

Checked on PUG, but probably affects much older versions