Apologies for the useless subject, but it will become obvious in a moment why I cannot be more specific.
I set up a new Virtualmin Pro server, added a test reseller, using my primary browser (Firefox). In another browser (Chromium) I logged in as the reseller and I noted a few oddities.
First of all, I could see a page that looked exactly the same as the "Edit Reseller" page in the master administrator account which, besides seeming to allow the reseller to change all of his limits, quotas, etc., showed a complete list of the "unowned domains" that only the master administrator should be able to see. It also seemed to allow the reseller to create his own resellers, which I had explicitly disallowed (the default) as the master administrator.
I logged out and went back to the master administrator account in Firefox so that I could impose some really low quota limits, so that I could try to change or exceed them in the resellers account.
Then I logged in again as the reseller in Chromium and ... the page had disappeared!
Unfortunately I have not been drinking, and since I didn't take screenshots the first time I have no proof and cannot show you how it's done. But the fact that I was using two different browsers means it's impossible that the page could somehow have been cached, which would surprise me anyway on an encrypted connection on a system requiring authentication.
But I didn't dream it. I swear. Weird.