diff --git a/lib/Service/AttachmentService.php b/lib/Service/AttachmentService.php
index 9d84806e7..8e401f2eb 100644
--- a/lib/Service/AttachmentService.php
+++ b/lib/Service/AttachmentService.php
@@ -272,6 +272,7 @@ public function update($cardId, $attachmentId, $data, $type = 'deck_file') {
 		}
 
 		if ($service instanceof ICustomAttachmentService) {
+			$this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);
 			try {
 				$attachment = new Attachment();
 				$attachment->setId($attachmentId);