I created a new user called "usertest" to understand what the basic permissions would be for a subscriber to my 3.0.1 multi-site. On any of this user's pages under the the right sidebar "Meta" menu item, this user can click on "admin" which brings up a skeleton of a dashboard with two menu items in the left sidebar, "Profile" and "Settings". The only thing that comes up when I click on the "Settings" is the cpanel for the plugin, "Superb Slideshow Glallery" which I have activated for my network.
This is a rather disturbing security breach, since it allows any user to change the images on my home page slide shows. Should the "settings" submenu be showing up at all? And if so why does it only reveal the "Superb Slideshow Gallery" cpanel?