Security error in p2 with subscribers

I think there is a security bug in the form of P2.
Users without permission as “collaborators” or “subscribers” registered can post even without permission to do so. The post did not even go through review by the editors to publish the form. However, since the administration to publish everything works fine.

Is it a bug or a feature? How can fix it?