While using new version if K2, I faced a strange behavior; if the category image is not available or if you misspell category image name in URL, K2 default media manager shows up in front-end.
If user has logged in Joomla admin area, media manager works and if not it shows login form!
I think that's a security bug and needs fast consideration, or I've messed up somewhere which I don't think because I haven't touched even a single line of code in K2.

Hi,
K2 media manager is available at frontend for a registered user but with no access for uploading or modifying any of the listed files - folders.

I guess you misunderstood my question.
Please see the following screenshots:

imgur.com/a/gaxno

Are you using any SEO/SEF extensions?

Nope. I'm only using clean Joomla installation and latest K2 component (2.7.0).
Although I've changed some of K2 SEO configurations like not showing category ID in URL, etc.

By default a 404 error is triggered when a file is not found on the server. Instead you have a redirect to onother url and specifically to the media view of the K2 component. Can you verify that your htaccess file is not modified ?

I only have default Joomla htaccess file and have never modified it.

I checked other websites using new version of K2 and navigating to a non-existent image in items or categories will result in showing media manager, and because of minimum access level required to show media manager, it shows login page if I'm not logged in!!

I just tried this in two different sites without replicating this behaviour.
Both nginx and Apache threw 404 errors.

Can you share you htaccess file?
Is your site live?
Do you have a /media menu item?

Well, I tried more different sites and problem seems to exist in all of them.
As I told you, I'm using default htaccess file on my local XAMPP which I found out about this problem.
I don't have a menu to media manager or anything like it
This is an example link using Nginx web server:
tourism.doctv.ir/media/k2/items/cache/94d43e327d9303539cb1e2aac7032668_M.jpg

I have other under development and live websites with same problem.