It looks like everyone can access the "Friends" admin menu, even subscribers!
This menu lets add and remove blog's friends and accept or deny new friends requests.
This ability should require a minimum role of Editor (or maybe even Administrator level). What do you think?
Could you correct this?