Can't access some endpoints (like .../{id}/messages) with client credentials grant getting a 401 without error body

I've set up a client and registered it on the portal, I've granted and approved all necessary permissions (application permissions) as an admin. Now, I'm trying to access e.g. the messages endpoint of a user with .../userId/messages as specified in the documentation, with a client access token and I'm getting a 401 unauthorized response with no error body (despite an error body implied according to documentation). The access token is valid and allows me to access the userId endpoint without messages. When I try to access other endpoints for which I haven't explicitly granted permissions, I'm getting a 403 as it should be, and when I try to access messages with an invalid token, I get 403 WITH an error body. The same problem is with mailFolders and some other endpoints. The decoded jwt access token does contain the roles specified by permissions e.g. Mail.ReadWrite.