A repository publisher without delete permission may modify protected package content under specific conditions.
CWE-862