diff --git a/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProvider.java b/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProvider.java
index 2e31c3b51e..10aba09a7e 100644
--- a/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProvider.java
+++ b/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProvider.java
@@ -352,7 +352,7 @@ class UserPrincipalProvider implements PrincipalProvider {
 
             String str = TreeUtil.getString(principalCache, CacheConstants.REP_GROUP_PRINCIPAL_NAMES);
             if (str == null || str.isEmpty()) {
-                return Collections.emptySet();
+                return new HashSet<>(1);
             }
 
             Set<Principal> groups = new HashSet<>();
diff --git a/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProviderWithCacheTest.java b/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProviderWithCacheTest.java
index 7077a5577a..8d50884afb 100644
--- a/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProviderWithCacheTest.java
+++ b/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/UserPrincipalProviderWithCacheTest.java
@@ -51,7 +51,6 @@ import org.apache.jackrabbit.oak.spi.security.principal.EveryonePrincipal;
 import org.apache.jackrabbit.oak.spi.security.principal.PrincipalImpl;
 import org.apache.jackrabbit.oak.spi.security.principal.PrincipalProvider;
 import org.apache.jackrabbit.oak.spi.security.user.UserConfiguration;
-import org.apache.jackrabbit.oak.util.NodeUtil;
 import org.apache.jackrabbit.oak.plugins.tree.TreeUtil;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
@@ -416,8 +415,13 @@ public class UserPrincipalProviderWithCacheTest extends AbstractPrincipalProvide
 
         // verify that the cache has really been updated
         cache = getCacheTree(systemRoot);
-        assertNotSame(2, new NodeUtil(cache).getLong(CacheConstants.REP_EXPIRATION, 2));
+        assertNotSame(2, TreeUtil.getLong(cache, CacheConstants.REP_EXPIRATION, 2));
         assertEquals("", TreeUtil.getString(cache, CacheConstants.REP_GROUP_PRINCIPAL_NAMES));
+
+        // check that an cached empty membership set doesn't break the retrieval
+        principalsAgain = pp.getPrincipals(userId);
+        assertFalse(principals.equals(principalsAgain));
+        assertPrincipals(principalsAgain, EveryonePrincipal.getInstance(), getTestUser().getPrincipal());
     }
 
     @Test