Steps to replicate the issue (include links if applicable):
- As a logged out user (or under non-sysop account), go to https://en.wikipedia.org/w/index.php?title=Prague&action=delete.
What happens?:
A deletion forms appears, despite logged out users not having the delete permission (nor bigdelete, which is needed to actually delete Prague from enwiki):
Actually submitting the form gives me an error message both logged out and from an insufficiently privileged account.
What should have happened instead?:
An error message should be shown, along the lines of "You need to be an administrator".
Notes
This issue gave me a mini heart attack for a short while and for a while I thought "OMG, logged out users can delete pages now, what happened". This has also confused at least one administrator who thought "I am not actually supposed to be able to delete big pages" (with more than 5k) revisions. So, this should be fixed even though it apparently isn't connected with a security vulnerability.