diff --git a/java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java b/java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java
index 76cbe7ef467..5e306f84daf 100755
--- a/java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java
+++ b/java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java
@@ -479,8 +479,7 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
             for (WildcardPermission requiredPermission : permissionsRequired) {
                 // TODO bug4763: obtain ownership and ACL through a provider pattern; providers may be passed to this panel's constructor
                 UserDTO anonymous = userService.getAnonymousUser();
-                if (PermissionChecker.isPermitted(requiredPermission, user, user.getUserGroups(), anonymous,
-                        anonymous.getUserGroups(), null, null)) {
+                if (PermissionChecker.isPermitted(requiredPermission, user, anonymous, null, null)) {
                     hasPermission = true;
                     break;
                 }
diff --git a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/PermissionChecker.java b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/PermissionChecker.java
index ac8bd0dc229..9fa52e73cfa 100755
--- a/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/PermissionChecker.java
+++ b/java/com.sap.sse.security.common/src/com/sap/sse/security/shared/PermissionChecker.java
@@ -1,5 +1,6 @@
 package com.sap.sse.security.shared;
 
+import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 
@@ -23,6 +24,24 @@ public class PermissionChecker {
         NONE
     }
     
+    /**
+     * @param permission
+     *            Permission of the form "data_object_type:action:instance_id". The instance id can be omitted when a
+     *            general permission for the data object type is asked after (e.g. "event:create"). If the action
+     *            contains more than one sub-part (divided by {@link WildcardPermission#SUBPART_DIVIDER_TOKEN}) then
+     *            this is considered an error, and an {@link IllegalArgumentException} will be thrown.
+     * @param ownership
+     *            may be {@code null}, causing user- or tenant-parameterized roles and no user ownership override to be
+     *            applied
+     * @param acl
+     *            may be {@code null} in which case no ACL-specific checks are performed
+     */
+    public static boolean isPermitted(WildcardPermission permission, SecurityUser user, SecurityUser allUser,
+            Ownership ownership, AccessControlList acl) {
+        return isPermitted(permission, user, user == null ? null : user.getUserGroups(),
+                allUser, allUser == null ? null : allUser.getUserGroups(), ownership, acl);
+    }
+
     /**
      * @param permission
      *            Permission of the form "data_object_type:action:instance_id". The instance id can be omitted when a
@@ -58,7 +77,10 @@ public class PermissionChecker {
                 }
                 action = (String) parts.get(1).toArray()[0];
             }
-            result = acl.hasPermission(action, groupsOfWhichUserIsMember);
+            Set<UserGroup> allGroups = new HashSet<>();
+            Util.addAll(groupsOfWhichUserIsMember, allGroups);
+            Util.addAll(allUserGroupsOfWhichUserIsMember, allGroups);
+            result = acl.hasPermission(action, allGroups);
         }
 
         // anonymous can only grant it if not already decided by acl
diff --git a/java/com.sap.sse.security.test/src/com/sap/sse/security/test/LoginTest.java b/java/com.sap.sse.security.test/src/com/sap/sse/security/test/LoginTest.java
index 68015872160..00d8ab9cc14 100755
--- a/java/com.sap.sse.security.test/src/com/sap/sse/security/test/LoginTest.java
+++ b/java/com.sap.sse.security.test/src/com/sap/sse/security/test/LoginTest.java
@@ -111,8 +111,7 @@ public class LoginTest {
         UserStoreImpl store2 = new UserStoreImpl(DEFAULT_TENANT_NAME);
         User allUser = userStore.getUserByName(SecurityService.ALL_USERNAME);
         User user = store2.getUserByName("me");
-        assertTrue(PermissionChecker.isPermitted(new WildcardPermission("a:b:c"), user, user.getUserGroups(), allUser,
-                allUser.getUserGroups(), null, null));
+        assertTrue(PermissionChecker.isPermitted(new WildcardPermission("a:b:c"), user, allUser, null, null));
     }
 
 }
diff --git a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserService.java b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserService.java
index e662b701847..350a1a7ea4e 100755
--- a/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserService.java
+++ b/java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserService.java
@@ -384,8 +384,7 @@ public class UserService {
         if (anonymousUser == null) {
             return false;
         }
-        return PermissionChecker.isPermitted(permission, currentUser, currentUser.getUserGroups(), anonymousUser,
-                anonymousUser.getUserGroups(), ownership, acl);
+        return PermissionChecker.isPermitted(permission, currentUser, anonymousUser, ownership, acl);
     }
 
     /**
diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/AbstractCompositeAuthorizingRealm.java b/java/com.sap.sse.security/src/com/sap/sse/security/AbstractCompositeAuthorizingRealm.java
index a8caee2f2cb..9372c15276f 100755
--- a/java/com.sap.sse.security/src/com/sap/sse/security/AbstractCompositeAuthorizingRealm.java
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/AbstractCompositeAuthorizingRealm.java
@@ -197,8 +197,7 @@ public abstract class AbstractCompositeAuthorizingRealm extends AuthorizingRealm
     private boolean isPermittedForUser(WildcardPermission wildcardPermission, User user, OwnershipAnnotation ownership,
             AccessControlListAnnotation acl) {
         User allUser = getUserStore().getUserByName(SecurityService.ALL_USERNAME);
-        return PermissionChecker.isPermitted(wildcardPermission, user, user == null ? null : user.getUserGroups(),
-                allUser, allUser == null ? null : allUser.getUserGroups(),
+        return PermissionChecker.isPermitted(wildcardPermission, user, allUser,
                 ownership == null ? null : ownership.getAnnotation(), acl == null ? null : acl.getAnnotation());
     }