This had nothing to do with permissions - it was a stale cache issue 
within Horde_Registry that only manifested itself in certain 
configurations.  Fixed in Horde_Core 2.12.4

Changes have been made in Git (master):

commit ab78d544c45810037890993878f1115edc44eaf6
Author: Michael M Slusarz <slusarz@horde.org>
Date:   Tue Jul 8 16:39:24 2014 -0600

     [mms] Fix clearing authentication-related registry caches when 
initializing a session in certain instances (Bug #13329).

  framework/Core/lib/Horde/Registry.php |    3 ++-
  framework/Core/package.xml            |    2 ++
  2 files changed, 4 insertions(+), 1 deletions(-)

http://github.com/horde/horde/commit/ab78d544c45810037890993878f1115edc44eaf6

With 'Mail' set as initial application, horde 5.2 will always start 
with the 'portal'-page. Allthough changing 'initial_application' to 
any other app (eg. 'Calendar' or 'Addressbook') results in starting 
with the chosen app. In Horde 5.1.6 'Mail' as the initial_application 
was accepted w/o problems.

On hunting this down, I came to the solution to hand over 
'Horde_Perms::SHOW' with 'hasPermission' in horde/index.php (line 64):
$registry->hasPermission($initial_app, Horde_Perms::SHOW))
as the function hasPermission in php/Horde/Registry.php on line 1699 
has a default of "HordePerms::READ" but checks on 'Horde_Perms::SHOW'

I do not understand what is going on here, especially as the 
hasPermission-code seems not to be changed from 5.1.6, but would my 
solution be correct?

Thanks for any hint,
Andreas