diff --git a/functions/api/uploads/_middleware.ts b/functions/api/uploads/_middleware.ts
index 551a2a2..e3109cc 100644
--- a/functions/api/uploads/_middleware.ts
+++ b/functions/api/uploads/_middleware.ts
@@ -2,7 +2,7 @@ export async function onRequest(context: RequestContext) {
   const { current_user: currentUser } = context.data;
 
   if (
-    !(currentUser?.permissions & (1 << 5)) ||
+    !(currentUser?.permissions & (1 << 5)) &&
     !(currentUser?.permissions & (1 << 12))
   )
     return new Response('{"error":"Forbidden"}', {