After Sun/Oracle DSEE 6.x, cn=config branch is not under root DN, and it is considered as a separated branch. Then, for non-Directory Manager users, you need to add an additional ACI to grant read access to cn=config, as the user needs permission to browse VLV indexes.