Hi Jon,
Global search through the GML plugin source code showed that it does not check any WordPress permissions at all. It did not call neither current_users_can() nor has_cap().
I don’t have the special recommendation in this case.
But as GML plugin uses/modifies AJAX requests for Media Library attachments which WordPress itself does, user should can at least ‘upload_files’ and ‘edit_post’ for the attachment itself and often for the post to which this image is attached. These permissions are checked by WordPress before work with Media Library items very often.
Thus user should can edit and delete published posts/pages and others posts/pages, etc.
So as you discovered to be at least an editor at the Media Library site.
