Have you put ACLs on the m2m table itself? The target tables, yeah, they're important also, but you still need to be able to edit the contents of the m2m table.

I didn't get specifics about that table (name, fields, etc.) from the screenshots. Thanks for those by the way!