HI,
Which role is assigned to that user , check by using "show user". check whether any CP-Profile mapped to that role (show rights <rolename>).
The MAC-auth-Default role mapped in the AAA profile should not have any CP profile mapped.
Here in this case only role is the suspicious
Please feel free for any further help on this.