Definitely bad behavior. Ideally, no one but privileged users should be able to edit the configuration imho but this opens the door for attackers.