If Modify Reporter permission is revoked from Service Desk Customer - Portal Access, then customers with mixed-case username can't edit request participants from Customer Portal.
- Edit an SD project's permission scheme and revoke Modify Reporter permission from Service Desk Customer - Portal Access
- Create a customer account with mixed-case username e.g. Adam
- Raise a request on behalf of Adam in the above project and add a participant to it
- Log in as Adam via Customer Portal
- Try to add a new participant to or remove the existing one from the above request
Participants can be added or removed normally.
- 500 error is thrown for adding participants (sharing)
- 400 error is thrown for removing participants (unsharing)
Grant Modify Reporter permission to Service Desk Customer - Portal Access. This doesn't allow customers to modify reporters, so shouldn't be a problem at all.