This is a tracking issue for a historic security vulnerability, fixed in !2836. Only the `can_display` permission was checked in the artifact relation creation and deletion endpoints. If a user (anonymous or authenticated) was able to see an artifact, they were able to create relationships between it and other artifacts, as well as deleting relationships to visible artifacts. Artifact relationships are traversed in a number of workflows, to locate artifacts to operate on, the impact of this has not been analyzed in depth, but presumably could be used by a malicious actor to make a task operate on the wrong artifact.