Non-owners have viewing/editing permissions?

[ltek]

Is it on purpose that roles (created using the web UI) have permissions to edit databases they do not own?