User can edit embedded office documents without create page permissions

User belongs to a group with 'view' and 'create attachments' permissions only.

The user will be able to upload attachments to a page but not edit or remove them. However, if an embedded document exists on the page a user will be able to edit this in Office via the page UI regardless of permissions.