Users can edit contact even if the necessary CMS permission isn't granted

In testing the Dashboard feature I disabled the "edit my contact" permission for authenticated users however my test user is able to edit any relatives that are displayed in the user's dashboard even though he cannot edit his own record.
Seemingly the edit button should not appear for his relatives just as it does not for his own records.

See images