diff --git a/.drone.env b/.drone.env
index 489058a2d49..37cbaaef710 100644
--- a/.drone.env
+++ b/.drone.env
@@ -1,4 +1,4 @@
 # The test runner source for API tests
-APITESTS_COMMITID=f4ae082265c54013f28e7facb892d6fdc943e827
+APITESTS_COMMITID=d45c26e8d2780b308cf0629bdf6ce87fb60a13fe
 APITESTS_BRANCH=dont-share-versions
 APITESTS_REPO_GIT_URL=https://github.com/owncloud/ocis.git
diff --git a/internal/http/services/owncloud/ocdav/versions.go b/internal/http/services/owncloud/ocdav/versions.go
index fa47d2f8da8..0eec232c079 100644
--- a/internal/http/services/owncloud/ocdav/versions.go
+++ b/internal/http/services/owncloud/ocdav/versions.go
@@ -149,6 +149,12 @@ func (h *VersionsHandler) doListVersions(w http.ResponseWriter, r *http.Request,
 		return
 	}
 	if lvRes.Status.Code != rpc.Code_CODE_OK {
+		if lvRes.Status.Code == rpc.Code_CODE_PERMISSION_DENIED {
+			w.WriteHeader(http.StatusForbidden)
+			b, err := errors.Marshal(http.StatusForbidden, "You have no permission to list file versions on this resource", "")
+			errors.HandleWebdavError(&sublog, w, b, err)
+			return
+		}
 		errors.HandleErrorStatus(&sublog, w, lvRes.Status)
 		return
 	}
@@ -226,6 +232,12 @@ func (h *VersionsHandler) doRestore(w http.ResponseWriter, r *http.Request, s *s
 		return
 	}
 	if res.Status.Code != rpc.Code_CODE_OK {
+		if res.Status.Code == rpc.Code_CODE_PERMISSION_DENIED {
+			w.WriteHeader(http.StatusForbidden)
+			b, err := errors.Marshal(http.StatusForbidden, "You have no permission to restore versions on this resource", "")
+			errors.HandleWebdavError(&sublog, w, b, err)
+			return
+		}
 		errors.HandleErrorStatus(&sublog, w, res.Status)
 		return
 	}