Steps to reproduce:
- Create 2 users, user A and user B
- Create a Form with User A
- Enable Require Authentication
- Add one field, publish publish Form
- Copy published URL
- Login with User B in another browser
- Open User's A Form with User B
- Wait until a draft is saved
- Try to add a Form
User B would be able to submit the form.
User B cannot submit form, error message saying "You do not have the required permissions" shows up. If Success Page is enabled, user will not even notice his entry was not submitted.
It should be OK if UPDATE permission is given to User's A Form.