I looked at the code and can confirm this bug. The problem was that I only validated the access rights when the user clicked / selected an item in the list view and not initially when the page loaded.
I’ll get this fixed in the next release – hopefully over next weekend.