Hi,
I’m using RouterOS v6.5 now. Users with Read permission can write and change many items.
Is this a bug in RouterOS?
Are you sure your config is ok?
I tested this on RB2011UAS, v6.5 mipsbe, no such issue.
Please show us your user, and group export, and also tell us what items can you change with that user.