The documentation doesn't mention anywhere that it's possible to use @ModelAttribute on an argument to a @ModelAttribute annotated method, like you're doing in your "getPermissionsModel()" method. It's possible that's not supported, since it's not documented as being supported. You might want to try either removing the "@ModelAttribute("user") User user" argument from your "getPermissionsModel()" method, and/or instead try just using one @ModelAttribute method to set all your model attributes:
@ModelAttribute
public void setAttributes(@PathVariable("userId") String userId, Model model) {
model.addAttribute(new PasswordValidation());
model.addAttribute(userManager.getUser(userId));
model.addAttribute(new PermissionsAvailable());
}