I was fighting to create an already tested state of: "a group [member] who can only manage users within the group foo" and kept failing, and I was thinking it's me:
# pveum acl modify /access/realm/pve -groups vmadmin -roles PVEUserAdmin
400 Parameter verification failed.
path: invalid ACL path...