Custom Settings have the same permission to edit the records and to edit the configuration. Both can be done with the “Configure Application” permission. With Custom Metadata, you can edit the records with “Configure Application” but you require “Author Apex” to edit the configuration.