If you have access to the Users List but not Add Users, you can still click the "Clone User" button. You get taken to the Add User screen. When you click "Save" you are redirected to a "you do not have permissions" message.
The Clone User button should not appear if you do not have the Add Users right.
Fixed in 4.0.61.1