diff --git a/lib/Service/CardService.php b/lib/Service/CardService.php
index f76ce220e..26fa3753c 100644
--- a/lib/Service/CardService.php
+++ b/lib/Service/CardService.php
@@ -195,6 +195,7 @@ class CardService {
 	}
 
 	public function assignUser($cardId, $userId) {
+		$this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);
 		$assignments = $this->assignedUsersMapper->find($cardId);
 		foreach ($assignments as $assignment) {
 			if ($assignment->getParticipant() === $userId) {
@@ -208,6 +209,7 @@ class CardService {
 	}
 
 	public function unassignUser($cardId, $userId) {
+		$this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);
 		$assignments = $this->assignedUsersMapper->find($cardId);
 		foreach ($assignments as $assignment) {
 			if ($assignment->getParticipant() === $userId) {