Steps to reproduce:
- In browser 1, log in as Admin
- Create a user called "UserA"
- add "UserA" to XWikiAdminGroup via the administration
- with browser 2, log in as "UserA": the home menu has an "administer wiki" link
- In browser 1, remove UserA from XWikiAdminGroup
- In browser 2, refresh: you can still administer the wiki
- In browser 2, log-out and log-on again: same, you can administer the wiki
If you restart the wiki, no problem anymore.