I think I've found the problem: there are two ways of mounting an application in a site or subsite and one of them is broken.
The fist way, the one that works fine, is going to the site-map, click on "add folder" to create de node, and then click on "new application" to mount the application in this new node. This way, the passed node_id is the right one, and the context_id (and therefore inherited permissions) are set fine.
The other way is going to the site-map, and using the "mount package" form, which creates the node and mounts the package in a single step. This is the one that does not set the context_id right, because the passed node_id corresponds to the parent node, the place under which we are trying to mount the new application.
Do I make myself clear?
I think this can be considered a bug, so if someone can confirm it, I'll post a bug in the bug tracker.
