The ReadingLists extension uses viewmyprivateinfo / editmyprivateinfo for access control. This was a poor choice when I made it, and even worse now that reading lists are getting more mainstream. There should be a dedicated pair of rights.

This is mainly a problem for OAuth apps that want to do something with reading lists. It's hard for the developer to figure out which grant to use, and for users what exactly they are giving permission for.