Ive been having a mysterious access denied error for site owners when they try to edit content query web parts on their sites, but site collection owners have no issues.
I ended up creating a copy of the limited access permission set and added "browse directories" and gave the site owners for that site this permission over the site collection.
Its better than giving them site collection owner status, but still I dont want to have to do this for every site owner.
My question is, what does this permission "Browse directories" give access to exactly? Im thinking some permissions got blown away by accident or something.
As it turns out, this doesnt occur in SharePoint 2010. So this is no longer an issue.