This case was reported on microsoft.public.cmserver.general group
Case:We have multiple websites hosted on the same CMS farm by mapping Channel Names to Host Header Names. On one of the sites any user whose is a member our AD group can create new page/posting