Able to add issue to active sprint when 'Schedule Issues' permission is not granted

We observed this behavior today for several developers in our production system and I was able to reproduce it in the staging system as well as for the latest JIRA + GH.

Steps to reproduce:

1. Prepare a SCRUM board for project 'DEMO'
2. Create a new sprint and start it
3. Remove 'Schedule Issues' permission for 'Developer' from permission scheme
4. Login as a sample user with 'Developer' role for project DEMO
5. Drag any issue from the backlog into the active sprint

Outcome:

Setup #1 (JIRA 5.1.5, GH 6.1.3.1)

1. Green box saying the issue has been added to the active sprint
2. Red box saying permissions for ranking are missing
3. Issue disappears from the backlog and after a refresh (F5) either:
   • appears in the active sprint
   • still appears in the backlog <- In this case, opening the issue in the JIRA issue view, the Agile tab shows it in the active sprint (!!!)
4. The burndown does not show the scope change (!)

Setup #2 (JIRA 5.2.10, GH 6.2)

1. Green box saying the issue has been added to the active sprint
2. Red box saying permissions for ranking are missing
3. Issue disappears from the backlog but appears in the active sprint after a refresh (F5)

Expectations:

• I would expect that a regular developer cannot add an issue to a sprint since this is actually a way more severe operation that ranking it.
• The issue should not disappear from the backlog / sprint even if an error message is thrown
• The reporting seems to miss the scope change in some cases (I am still trying to reproduce this on GH 6.2 - I might upgrade our staging system using a copy of the production data)