is it a bug in the login?

I found a possible bug…
or just a possible wrong path for the login.
I’m using a:
4.2.2 wp version
buddypress Version 2.2.3.1
heme My Login Version 6.3.12.
I was logged as Admin user on a normal chrome window.
Then i open a new browser istance as incognito mode using a link allready opened on the normal page. ( I click on a link of the admin panel using “open it in a private window” aka incognito mode).
As normal the new incognito page ask me to log in.
So I used a normal user account to login.
But with nonsense reason I got admin privileges without having set it on the current user.

So copying and using an admin link can give you admin privileges for all user?

I hope that this description is clear enough