I've tried putting an IPv6 IP into the IP Access Control box under "Security and limits options". I chose "Only allow from listed addresses" and put an IPv4 and IPv6 IP into the box below. Both IPs were accepted and put into the user config in /etc/webmin/miniserv.users however if I look at the settings again for the user, the colons in the IPv6 IP are apparently getting interpreted as the different fields in the user entry of miniserv.users.
Thanks for pointing this out - I will fix this in the next Webmin release (1.610).