Steps to reproduce:
Create two host groups: Group Read, Group Write, Group Test
Assign our host Test to Group Read, Group Write.

Our Test User has R/W permissions on Group Write, R/W permissions on Group Test, R permissions on Group Read.

Execute hostgroup.massupdate to assign the Host to Group Test with our Test User.
Receive: No permissions to referred object or it does not exist!

Assigning the group in the frontend works just fine with said user.
If the host is removed from Group Read, the API call also works fine.