User with Salesforce Report Folder View Access Can Save and Edit Reports

This behavior is related to the Edit My Reports profile permission, which is only ‌available for organizations with Enhanced Folder Sharing enabled.

This profile permission, when enabled, gives a user the ability to save a report to a public folder they may only have View access to. Additionally, this profile permission allows them to edit reports they've saved to the folder. Removing this profile permission removes the ability to save reports to the public folder. However, it preserves their ability to create, edit, or clone reports to their Personal Custom Reports folder. 

Notes: 

• If your organization was created after the Summer ’13 Salesforce release, you already have Enhanced Folder Sharing
• If your organization existed before the Summer ’13, follow the steps in the link below to enable the feature
• The same behavior can be applied to dashboards and dashboard folders

For more information on permissions to create, edit, and delete public reports and dashboard folders, see the Help on Managing Folders.