Authorization scope for API calls favourited_by and reblogged_by #1911

https://github.com/mastodon/documentation/blob/main/content/en/methods/statuses.md?plain=1#L944 says that the OAuth user token for /api/v1/statuses/:id/favourited_by needs scope read:statuses for private statuses. In contrast to this, the source code (https://github.com/mastodon/mastodon/blob/main/app/controllers/api/v1/statuses/favourited_by_accounts_controller.rb#L4) looks like scope read:accounts is required. (Also the actual behavior requires read:accounts.)

The same problem seems to exist for /api/v1/statuses/:id/reblogged_by.

Or does the API documentation correctly describe the intended behavior and there is a bug in the implementation?