diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/model/session/WebSession.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/model/session/WebSession.java
index cf29b9533d..1f31ed19e7 100644
--- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/model/session/WebSession.java
+++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/model/session/WebSession.java
@@ -184,7 +184,12 @@ public class WebSession {
     private void refreshSessionAuth() throws DBCException {
         CBApplication application = CBPlatform.getInstance().getApplication();
         if (this.user == null) {
-            sessionPermissions = application.getSecurityController().getSubjectPermissions(application.getAppConfiguration().getAnonymousUserRole());
+            if (application.getAppConfiguration().isAnonymousAccessEnabled()) {
+                sessionPermissions = application.getSecurityController().getSubjectPermissions(
+                    application.getAppConfiguration().getAnonymousUserRole());
+            } else {
+                sessionPermissions = Collections.emptySet();
+            }
         } else {
             sessionPermissions = application.getSecurityController().getUserPermissions(this.user.getUserId());
         }
diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java
index 32fe65101e..0b15e2353b 100644
--- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java
+++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/CBSecurityController.java
@@ -377,7 +377,7 @@ class CBSecurityController implements DBWSecurityController {
         try (Connection dbCon = database.openConnection()) {
             Set<String> permissions = new HashSet<>();
             try (PreparedStatement dbStat = dbCon.prepareStatement(
-                "SELECT UNIQUE AP.PERMISSION_ID FROM CB_AUTH_PERMISSIONS AP,CB_USER_ROLE UR\n" +
+                "SELECT DISTINCT AP.PERMISSION_ID FROM CB_AUTH_PERMISSIONS AP,CB_USER_ROLE UR\n" +
                     "WHERE UR.ROLE_ID=AP.SUBJECT_ID AND UR.USER_ID=?")) {
                 dbStat.setString(1, userId);
                 try (ResultSet dbResult = dbStat.executeQuery()) {
@@ -397,7 +397,7 @@ class CBSecurityController implements DBWSecurityController {
             permissions.addAll(getSubjectPermissions(userId));
             return permissions;
         } catch (SQLException e) {
-            throw new DBCException("Error saving role in database", e);
+            throw new DBCException("Error reading user permissions", e);
         }
     }