When editing permissions for Access Control Lists under roles in the security app, the option "sub nodes" is not handled properly when no path or the root path is chosen.

The dialog is saving properly but when re-opening, you can see that now the option "selected and sub nodes" is shown instead of only "sub nodes".

If the "sub nodes" option is not allowed on root nodes, then validation should handle that when trying to save.