Everyone can see CMF in user profile?

cmf-6.x-2.0 == I have the same problem on my site too. Resetting permissions to an admin role and NOT any of my customer roles had no effect.

I also can't seem to rebuild permissions -- this problem didn't show up until close to the time I installed this module, and I haven't been able to track that issue down either. After rebuilding permissions I get this:
The content access permissions have not been properly rebuilt.
The content access permissions need to be rebuilt.

Confirmed: Latest dev version, released in Oct, 2009 (http://ftp.drupal.org/files/projects/cmf-6.x-2.x-dev.tar.gz) does not contain this issue. It looks like the issue was introduced in the release version, in Sept. 2009 in the function: _cmf_userspace_perms(). but the dev version has that function reverted back to the older version.

If this is fixed in development version from 2009, would it be possible to have it ported to a recommended release? Thanks.

"If this is fixed..." tells me you haven't tried it to find out.

Yes, you are right, sorry. I have tested the dev version now, and can confirm that it is working in dev version from 2010-Dec-01.

And there is a new version as well.

Thanks a lot for your great work.

i've installed the dev version and it's still displaying the tabs even for users not logged in which is really not good. no one has the permission for cmf either so I have no idea why this would do this.

any other ideas how to fix this?

Not at the moment