Unclear if this is a bug or "by design".
I have a "normal" user account, and trying to read some meta-data custom properties that are set on each of the repositories that I have access.
When I use the REST API for /scm/api/rest/repositories.json, the properties object is empty, however when one of our admins does this, all properties are returned.
It would seem to me that if a user has READ or WRITE access to a repository, they should be able to read the properties. Again not sure if this behavior is by design or a bug - or if there's a way to make a non-admin user able to read the properties.
I've attached a sample app that uses the Java client API that can be used to demonstrate the problem.