Steps to Reproduce:

1. Using a user that does not have rights to merge on a given repository
2. Open the pull request overview
3. Observe that "Merge pull request"/"Close pull request" buttons are enabled

I did not click them out of fear, uncertainty and doubt