diff --git a/src/PVE/RPCEnvironment.pm b/src/PVE/RPCEnvironment.pm
index 8ecbbd9..5e0ef04 100644
--- a/src/PVE/RPCEnvironment.pm
+++ b/src/PVE/RPCEnvironment.pm
@@ -82,7 +82,8 @@ my $compile_acl_path = sub {
     if ($username && $username ne 'root@pam') {
 	# intersect user and token permissions
 	my $user_privs = $cache->{$username}->{privs}->{$path};
-	$privs = { map { $_ => $user_privs->{$_} && $privs->{$_} } keys %$privs };
+	my $filtered_privs = [ grep { $user_privs->{$_} } keys %$privs ];
+	$privs = { map { $_ => $user_privs->{$_} && $privs->{$_} } @$filtered_privs };
     }
 
     $data->{privs}->{$path} = $privs;