EDIT

import java.util.stream.Collectors;

import org.hibernate.Session;

import org.hibernate.Transaction;

import org.springframework.security.core.GrantedAuthority;

import eu.etaxonomy.cdm.model.common.Group;

import eu.etaxonomy.cdm.model.common.User;

        if(deleteCandidates.isEmpty()){

            return;

        }

        // -----------------------------------------------------------------------------------------

        // this needs to be executed in a separate session to avoid concurrent modification problems

        Session newSession = session.getSessionFactory().openSession();

        Transaction txState = newSession.beginTransaction();

        Query userQuery = newSession.createQuery("select u from User u join u.grantedAuthorities ga where ga.authority in (:authorities)");

        userQuery.setParameterList("authorities", authorityStrings);

        List<User> users = userQuery.list();

        for(User user : users){

            List<GrantedAuthority> deleteFromUser = user.getGrantedAuthorities().stream().filter(

                        ga -> authorityStrings.contains(ga.getAuthority())

                    )

                    .collect(Collectors.toList());

            user.getGrantedAuthorities().removeAll(deleteFromUser);

        }

        Query groupQuery = newSession.createQuery("select g from Group g join g.grantedAuthorities ga where ga.authority in (:authorities)");

        groupQuery.setParameterList("authorities", authorityStrings);

        List<Group> groups = groupQuery.list();

        for(Group group : groups){

            List<GrantedAuthority> deleteFromUser = group.getGrantedAuthorities().stream().filter(

                        ga -> authorityStrings.contains(ga.getAuthority())

                    )

                    .collect(Collectors.toList());

            group.getGrantedAuthorities().removeAll(deleteFromUser);

        }

        newSession.flush();

        txState.commit();

        newSession.close();

        // -----------------------------------------------------------------------------------------

        Query deleteQuery = session.createQuery(hql);

        deleteQuery.setParameterList("authorities", authorityStrings);

        deleteQuery.setFlushMode(FlushMode.MANUAL); // workaround for  HHH-11822 (https://hibernate.atlassian.net/browse/HHH-11822)

        deleteQuery.executeUpdate();