Same. Tested with a "Level 1" user type.. Manage own Extension in the GUI.
Logged on, can see the password in Options.. but cannot change the value.
I'd rather they can change their web management/admin password than their extension password, frankly. Changing their extension password breaks their CTI, their handset, and their softphone.
In fact.. I'd rather they just could access forwarding rules. The idea would be to access the website from wherever, login, and adjust the rules and/or status.. WITHOUT needing the app installed and configured. Happens with traveling users who forgot to set their OoO to forward to cell or similar.
TL;DR - Would be nice to have more granular permissions here.