Access to some civicrm/admin URLs allowed without Adminster Civicrm permissions

Someone without Administer CIviCRM permission can get to some pages that start with civicrm/admin as detailed below.

1. A logged in user w/o Administer CIviCRM but with Access Event permissions can access and make changes to the following pages if they go directly to the URL:

/civicrm/admin/price?reset=1
/civicrm/admin/price?reset=1&action=add.

ie, you can create or alter a price set without Access Civicrm or Administer Civicrm permissions.

2. The following cases are not as clear but I think a logged in user w/o Administer CIviCRM but with Access CiviMail permissions can access and make changes to the following pages if they go directly to the URL:

/civicrm/admin/mailSettings?reset=1
/civicrm/admin/component?reset=1
/civicrm/admin/mail?reset=1

3. A logged in user w/o Administer CIviCRM but with Access Report permissions can access the following pages if they go directly to the URL

civicrm/admin/report/options/report_template?reset=1
civicrm/admin/report/template/list?reset=1

I am not sure if they can actually do any harm - there were too many reports for me to test and perhaps Access CiviReports is a special case where they should be able to do that anyway.

This came from CRM-14841