The following type of SQL statement succeeds, regardless of the users permissions on your_table:
ALTER TABLE mytable ADD CONSTRAINT fk_ref FOREIGN KEY (x) REFERENCES your_table(y)
ALTER TABLE was failing to check if the user had REFERENCES permission on your_table, which is required to create such a constraint. This logic has been corrected.