I saw that too...and been going through the ACLs to find where...they are identical (albeit, so far as I have found) between the two servers.
I would suggest you slapcat cn=config for each master, and do a diff of the database portion.
--Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration