Issue #13578 open
Now read-only users are able to upload arbitrary file by using Add files button at Downloads page, however they cannot delete their uploaded file.
- Prohibit read-only users to upload file
- Make users available to delete their own uploaded files even they don't have a write privilege
There's no workaround except asking repository owner or Atlassian support.