EDIT

I observed the following problems while implementing the ExtendedCreatePermissionManager for #6867

when this sequence is used (snipped from CdmStore.java):

T mergedBean = mergedBean(bean);
repo.getCommonService().save(mergedBean);
session.flush();

the flush causes the bean being saved a second time, since hibernate assumes that the entity is dirty and schedules a save operation. For this save the user would need the UPDATE permission, and the save operation fails.