We should at least maybe add the uploader userid if known and allow deletion if it is the same or an admin ?  Some work for security is done on the subject on #7956 but I remember that some test still doesn't pass and haven't much time to work on it.