pkg/services/tree/signature.go

@@ -77,6 +77,11 @@ func (s *Service) verifyClient(req message, cid cidSDK.ID, rawBearer []byte, op
 	}
 
 	basicACL := cnr.Value.BasicACL()
+	// Basic ACL mask can be unset, if a container operations are performed
+	// with strict APE checks only.
+	if basicACL == 0x0 {
+		return nil
+	}
 
 	if !basicACL.IsOpAllowed(op, role) {
 		return basicACLErr(op)