The patch for the workaround is on the forge link provided in my earlier post. We've resolved the issue at the source rather then treating a symptom (as this fix does). At any rate you can just copy cb.acl.php from you Dev server to your Live server as it's pre-patched (you'll need CB 1.8 of course).
We're using CB 1.8 RC here at Joomlapolis so we consider it pretty stable, but we did find some ACL bugs for J1.5, but if on J1.6+ it works quite stable. I recommend waiting for a stable release or at least RC2 before pushing to a live site however. We're working to release RC2/Stable this week or next week at most (just an internal goal, not a release date).