API Permissions missing

Running CiviCRM 4.6.8 on Drupal 7.39 (MySQL 5.5.44, PHP 5.4.41, Apache 2.2.22, Debian 7.8). Issue was noticed in 1.4, and upgrading to 1.4.1 didn't resolve the issue.

CiviVolunteer works flawlessly for the Drupal site's administrative user (which has all permissions), and the "Define Volunteer Needs" and "Assign Volunteers" functions work well for all users. However, when trying to use the "Log Volunteer Hours" function as a user other than the Drupal admin, the dialogue will open and be populated, but the contents never stops being greyed over and the rotating loading triangle never disappears. This has been tested, with identical results, in the latest versions of IE, Firefox, and Chrome.

The browser's console output complains about an exception in the JQuery code that a variable is undefined. Further digging points to the script used to fetch Commendations, which relies on CiviCRM's API. This suggests that normal users don't have appropriate permissions for the Commendations API call, and would explain why the dialogue only works for the admin account, since, according to http://wiki.civicrm.org/confluence/display/CRMDOC/API+Security, "Administer CiviCRM" is necessary for any API calls without explicit permissions. A search of the relevant API permissions file turns up no obvious CiviVolunteer-related results.

Unfortunately, these missing permissions are preventing staff who are not CiviCRM administrators (which is basically all of them) from logging volunteer hours, which for many organizations (including the one I work for) is its single most important feature.

It seems like it should be a simple fix, but I don't know the extension (or the API permissions regime) well enough (yet) to contribute a patch.

Thanks!