Should TICKET_MODIFY (accept/assign/close) be available to all logged-in accounts on core Trac?

[modi2918]

While reporting a ticket on core Trac, I noticed that the "Action" box (leave as new / assign to / accept / review to / close as fixed) and ticket property fields (Version, Milestone, etc.) are editable by any logged-in WordPress.org account — not only by Core Team members or committers.

I understand Trac's TICKET_MODIFY permission is likely granted broadly to support contributor workflows (e.g. self-assigning a ticket to work on it). I'm not flagging this as a security issue since actual code changes still require SVN commit access, which is separately restricted.

However, I wanted to raise it for visibility/discussion, since as a non-committer I was able to:

• Select "accept" (which would set me as ticket owner)
• Select "close as fixed" (which would set resolution to fixed/closed)
• Change the Version field to any release version

For someone unfamiliar with WordPress's Trac conventions, this could lead to accidental misuse (e.g. closing tickets or misreporting affected versions) even though no core code is actually changed.

Is this the intended/expected permission setup, or is there a recommended way to restrict these actions to trusted contributors while still allowing general ticket submission (Summary/Description/Type)?

Happy to provide screenshots if useful.

[Otto42]

Yes, I believe this is intentional as anybody can contribute to WordPress. It's been set up like this for at least 20 years.