Index: /trunk/wp-admin/async-upload.php
===================================================================
--- /trunk/wp-admin/async-upload.php	(revision 6829)
+++ /trunk/wp-admin/async-upload.php	(revision 6830)
@@ -17,4 +17,8 @@
 
 header('Content-Type: text/plain');
+
+if ( !current_user_can('upload_files') )
+	wp_die(__('You do not have permission to upload files.'));
+
 $id = media_handle_upload('async-upload', $_REQUEST['post_id']);
 if (is_wp_error($id)) {