diff --git a/pkg/services/tree/signature.go b/pkg/services/tree/signature.go
index 15067d3c..985e1ad9 100644
--- a/pkg/services/tree/signature.go
+++ b/pkg/services/tree/signature.go
@@ -77,6 +77,11 @@ func (s *Service) verifyClient(req message, cid cidSDK.ID, rawBearer []byte, op
 	}
 
 	basicACL := cnr.Value.BasicACL()
+	// Basic ACL mask can be unset, if a container operations are performed
+	// with strict APE checks only.
+	if basicACL == 0x0 {
+		return nil
+	}
 
 	if !basicACL.IsOpAllowed(op, role) {
 		return basicACLErr(op)