A user with the viewer role can see plan info. We didn't try submit changes but the links to change the invoice email and payment info are shown and will display and edit form when clicked. This seems to be something that only an Admin role should be able to access.
Jeff Stern
marked this post as
complete
Thanks for bringing this to our attention. We disabled viewers from being able to see plan information.