If I'm not mistaken, the undo feature is built into the ['edit'] right, and by default ['*'](everybody) has ['edit'] so anonymous and non-autoconfirmed folks have access to undo edits.
In my experience, 90% of the time undo is used by anonymous users, it's used to edit war vandalism or spam back into an article. This bug is requesting that undo be it's own separate right and adding setting $wgGroupPermissions['*']['undo'] = true; on DefaultSettings.php, to keep it identical to the existing default settings, and allow other folks to change their own LocalSettings.php as warranted.
Version: 1.13.x
Severity: enhancement