Object cache for users can contains users group data (User::saveToCache).
When constructing a User object and getting user groups (via User::getGroups, as done for Special:Listusers, Special:Preferences, API userinfo, mw.config, and user group permissions, pretty much everything) - and there is cache - it means changing user groups will be ineffective.
It will appear as though the user groups haven't changed at all. Just ran into this on a small wiki of mine, took a while to figure out that it was the object cache.
Version: unspecified
Severity: normal