diff --git a/apps/dav/lib/SystemTag/SystemTagMappingNode.php b/apps/dav/lib/SystemTag/SystemTagMappingNode.php
index 344ff1dbc70a9..a0dc855778b07 100644
--- a/apps/dav/lib/SystemTag/SystemTagMappingNode.php
+++ b/apps/dav/lib/SystemTag/SystemTagMappingNode.php
@@ -37,55 +37,29 @@
  * Mapping node for system tag to object id
  */
 class SystemTagMappingNode implements \Sabre\DAV\INode {
-	/**
-	 * @var ISystemTag
-	 */
-	protected $tag;
-
-	/**
-	 * @var string
-	 */
+	/** @var ISystemTag */
+	private $tag;
+	/** @var string */
 	private $objectId;
-
-	/**
-	 * @var string
-	 */
+	/** @var string */
 	private $objectType;
-
-	/**
-	 * User
-	 *
-	 * @var IUser
-	 */
-	protected $user;
-
-	/**
-	 * @var ISystemTagManager
-	 */
-	protected $tagManager;
-
-	/**
-	 * @var ISystemTagObjectMapper
-	 */
+	/** @var IUser */
+	private $user;
+	/** @var ISystemTagManager */
+	private $tagManager;
+	/** @var ISystemTagObjectMapper */
 	private $tagMapper;
+	/** @var \Closure */
+	private $childWriteAccessFunction;
 
-	/**
-	 * Sets up the node, expects a full path name
-	 *
-	 * @param ISystemTag $tag system tag
-	 * @param string $objectId
-	 * @param string $objectType
-	 * @param IUser $user user
-	 * @param ISystemTagManager $tagManager
-	 * @param ISystemTagObjectMapper $tagMapper
-	 */
 	public function __construct(
 		ISystemTag $tag,
-		$objectId,
-		$objectType,
+		string $objectId,
+		string $objectType,
 		IUser $user,
 		ISystemTagManager $tagManager,
-		ISystemTagObjectMapper $tagMapper
+		ISystemTagObjectMapper $tagMapper,
+		\Closure $childWriteAccessFunction
 	) {
 		$this->tag = $tag;
 		$this->objectId = $objectId;
@@ -93,6 +67,7 @@ public function __construct(
 		$this->user = $user;
 		$this->tagManager = $tagManager;
 		$this->tagMapper = $tagMapper;
+		$this->childWriteAccessFunction = $childWriteAccessFunction;
 	}
 
 	/**
@@ -161,6 +136,10 @@ public function delete() {
 			if (!$this->tagManager->canUserAssignTag($this->tag, $this->user)) {
 				throw new Forbidden('No permission to unassign tag ' . $this->tag->getId());
 			}
+			$writeAccessFunction = $this->childWriteAccessFunction;
+			if (!$writeAccessFunction($this->objectId)) {
+				throw new Forbidden('No permission to unassign tag to ' . $this->objectId);
+			}
 			$this->tagMapper->unassignTags($this->objectId, $this->objectType, $this->tag->getId());
 		} catch (TagNotFoundException $e) {
 			// can happen if concurrent deletion occurred
diff --git a/apps/dav/lib/SystemTag/SystemTagsObjectMappingCollection.php b/apps/dav/lib/SystemTag/SystemTagsObjectMappingCollection.php
index 8bb34182b0c2b..7b6d5279d5d99 100644
--- a/apps/dav/lib/SystemTag/SystemTagsObjectMappingCollection.php
+++ b/apps/dav/lib/SystemTag/SystemTagsObjectMappingCollection.php
@@ -40,56 +40,33 @@
  * Collection containing tags by object id
  */
 class SystemTagsObjectMappingCollection implements ICollection {
-
-	/**
-	 * @var string
-	 */
+	/** @var string */
 	private $objectId;
-
-	/**
-	 * @var string
-	 */
+	/** @var string */
 	private $objectType;
-
-	/**
-	 * @var ISystemTagManager
-	 */
+	/** @var IUser */
+	private $user;
+	/** @var ISystemTagManager */
 	private $tagManager;
-
-	/**
-	 * @var ISystemTagObjectMapper
-	 */
+	/** @var ISystemTagObjectMapper */
 	private $tagMapper;
+	/** @var \Closure */
+	protected $childWriteAccessFunction;
 
-	/**
-	 * User
-	 *
-	 * @var IUser
-	 */
-	private $user;
-
-
-	/**
-	 * Constructor
-	 *
-	 * @param string $objectId object id
-	 * @param string $objectType object type
-	 * @param IUser $user user
-	 * @param ISystemTagManager $tagManager tag manager
-	 * @param ISystemTagObjectMapper $tagMapper tag mapper
-	 */
 	public function __construct(
-		$objectId,
-		$objectType,
+		string $objectId,
+		string $objectType,
 		IUser $user,
 		ISystemTagManager $tagManager,
-		ISystemTagObjectMapper $tagMapper
+		ISystemTagObjectMapper $tagMapper,
+		\Closure $childWriteAccessFunction
 	) {
-		$this->tagManager = $tagManager;
-		$this->tagMapper = $tagMapper;
 		$this->objectId = $objectId;
 		$this->objectType = $objectType;
 		$this->user = $user;
+		$this->tagManager = $tagManager;
+		$this->tagMapper = $tagMapper;
+		$this->childWriteAccessFunction = $childWriteAccessFunction;
 	}
 
 	public function createFile($name, $data = null) {
@@ -103,7 +80,10 @@ public function createFile($name, $data = null) {
 			if (!$this->tagManager->canUserAssignTag($tag, $this->user)) {
 				throw new Forbidden('No permission to assign tag ' . $tagId);
 			}
-
+			$writeAccessFunction = $this->childWriteAccessFunction;
+			if (!$writeAccessFunction($this->objectId)) {
+				throw new Forbidden('No permission to assign tag to ' . $this->objectId);
+			}
 			$this->tagMapper->assignTags($this->objectId, $this->objectType, $tagId);
 		} catch (TagNotFoundException $e) {
 			throw new PreconditionFailed('Tag with id ' . $tagId . ' does not exist, cannot assign');
@@ -204,7 +184,8 @@ private function makeNode(ISystemTag $tag) {
 			$this->objectType,
 			$this->user,
 			$this->tagManager,
-			$this->tagMapper
+			$this->tagMapper,
+			$this->childWriteAccessFunction,
 		);
 	}
 }
diff --git a/apps/dav/lib/SystemTag/SystemTagsObjectTypeCollection.php b/apps/dav/lib/SystemTag/SystemTagsObjectTypeCollection.php
index 1ca45c32ce46b..fe9d0acff238c 100644
--- a/apps/dav/lib/SystemTag/SystemTagsObjectTypeCollection.php
+++ b/apps/dav/lib/SystemTag/SystemTagsObjectTypeCollection.php
@@ -38,61 +38,37 @@
  * Collection containing object ids by object type
  */
 class SystemTagsObjectTypeCollection implements ICollection {
-
-	/**
-	 * @var string
-	 */
+	/** @var string */
 	private $objectType;
-
-	/**
-	 * @var ISystemTagManager
-	 */
+	/** @var ISystemTagManager */
 	private $tagManager;
-
-	/**
-	 * @var ISystemTagObjectMapper
-	 */
+	/** @var ISystemTagObjectMapper */
 	private $tagMapper;
-
-	/**
-	 * @var IGroupManager
-	 */
-	private $groupManager;
-
-	/**
-	 * @var IUserSession
-	 */
+	/** @var IUserSession */
 	private $userSession;
-
-	/**
-	 * @var \Closure
-	 **/
+	/** @var IGroupManager */
+	private $groupManager;
+	/** @var \Closure */
 	protected $childExistsFunction;
+	/** @var \Closure */
+	protected $childWriteAccessFunction;
 
-	/**
-	 * Constructor
-	 *
-	 * @param string $objectType object type
-	 * @param ISystemTagManager $tagManager
-	 * @param ISystemTagObjectMapper $tagMapper
-	 * @param IUserSession $userSession
-	 * @param IGroupManager $groupManager
-	 * @param \Closure $childExistsFunction
-	 */
 	public function __construct(
-		$objectType,
+		string $objectType,
 		ISystemTagManager $tagManager,
 		ISystemTagObjectMapper $tagMapper,
 		IUserSession $userSession,
 		IGroupManager $groupManager,
-		\Closure $childExistsFunction
+		\Closure $childExistsFunction,
+		\Closure $childWriteAccessFunction
 	) {
+		$this->objectType = $objectType;
 		$this->tagManager = $tagManager;
 		$this->tagMapper = $tagMapper;
-		$this->objectType = $objectType;
 		$this->userSession = $userSession;
 		$this->groupManager = $groupManager;
 		$this->childExistsFunction = $childExistsFunction;
+		$this->childWriteAccessFunction = $childWriteAccessFunction;
 	}
 
 	/**
@@ -129,7 +105,8 @@ public function getChild($objectName) {
 			$this->objectType,
 			$this->userSession->getUser(),
 			$this->tagManager,
-			$this->tagMapper
+			$this->tagMapper,
+			$this->childWriteAccessFunction,
 		);
 	}
 
diff --git a/apps/dav/lib/SystemTag/SystemTagsRelationsCollection.php b/apps/dav/lib/SystemTag/SystemTagsRelationsCollection.php
index 4c179d5f0f661..a6be9671bfbf8 100644
--- a/apps/dav/lib/SystemTag/SystemTagsRelationsCollection.php
+++ b/apps/dav/lib/SystemTag/SystemTagsRelationsCollection.php
@@ -26,6 +26,7 @@
  */
 namespace OCA\DAV\SystemTag;
 
+use OCP\Constants;
 use OCP\IGroupManager;
 use OCP\IUserSession;
 use OCP\SystemTag\ISystemTagManager;
@@ -36,7 +37,6 @@
 use Symfony\Component\EventDispatcher\EventDispatcherInterface;
 
 class SystemTagsRelationsCollection extends SimpleCollection {
-
 	/**
 	 * SystemTagsRelationsCollection constructor.
 	 *
@@ -60,10 +60,19 @@ public function __construct(
 				$tagMapper,
 				$userSession,
 				$groupManager,
-				function ($name) {
+				function ($name): bool {
 					$nodes = \OC::$server->getUserFolder()->getById((int)$name);
 					return !empty($nodes);
-				}
+				},
+				function ($name): bool {
+					$nodes = \OC::$server->getUserFolder()->getById((int)$name);
+					foreach ($nodes as $node) {
+						if (($node->getPermissions() & Constants::PERMISSION_UPDATE) === Constants::PERMISSION_UPDATE) {
+							return true;
+						}
+					}
+					return false;
+				},
 			),
 		];
 
@@ -77,7 +86,10 @@ function ($name) {
 				$tagMapper,
 				$userSession,
 				$groupManager,
-				$entityExistsFunction
+				$entityExistsFunction,
+				function ($name) {
+					return true;
+				},
 			);
 		}
 
diff --git a/apps/dav/tests/unit/SystemTag/SystemTagMappingNodeTest.php b/apps/dav/tests/unit/SystemTag/SystemTagMappingNodeTest.php
index e39cb0a04d3dd..b6078e69d6302 100644
--- a/apps/dav/tests/unit/SystemTag/SystemTagMappingNodeTest.php
+++ b/apps/dav/tests/unit/SystemTag/SystemTagMappingNodeTest.php
@@ -33,20 +33,11 @@
 use OCP\SystemTag\TagNotFoundException;
 
 class SystemTagMappingNodeTest extends \Test\TestCase {
-
-	/**
-	 * @var \OCP\SystemTag\ISystemTagManager
-	 */
+	/** @var ISystemTagManager */
 	private $tagManager;
-
-	/**
-	 * @var \OCP\SystemTag\ISystemTagObjectMapper
-	 */
+	/** @var ISystemTagObjectMapper */
 	private $tagMapper;
-
-	/**
-	 * @var \OCP\IUser
-	 */
+	/** @var IUser */
 	private $user;
 
 	protected function setUp(): void {
@@ -60,7 +51,7 @@ protected function setUp(): void {
 			->getMock();
 	}
 
-	public function getMappingNode($tag = null) {
+	public function getMappingNode($tag = null, array $writableNodeIds = []) {
 		if ($tag === null) {
 			$tag = new SystemTag(1, 'Test', true, true);
 		}
@@ -70,7 +61,10 @@ public function getMappingNode($tag = null) {
 			'files',
 			$this->user,
 			$this->tagManager,
-			$this->tagMapper
+			$this->tagMapper,
+			function ($id) use ($writableNodeIds): bool {
+				return in_array($id, $writableNodeIds);
+			},
 		);
 	}
 
@@ -83,8 +77,8 @@ public function testGetters() {
 		$this->assertEquals('files', $node->getObjectType());
 	}
 
-	public function testDeleteTag() {
-		$node = $this->getMappingNode();
+	public function testDeleteTag(): void {
+		$node = $this->getMappingNode(null, [123]);
 		$this->tagManager->expects($this->once())
 			->method('canUserSeeTag')
 			->with($node->getSystemTag())
@@ -102,6 +96,25 @@ public function testDeleteTag() {
 		$node->delete();
 	}
 
+	public function testDeleteTagForbidden(): void {
+		$node = $this->getMappingNode();
+		$this->tagManager->expects($this->once())
+			->method('canUserSeeTag')
+			->with($node->getSystemTag())
+			->willReturn(true);
+		$this->tagManager->expects($this->once())
+			->method('canUserAssignTag')
+			->with($node->getSystemTag())
+			->willReturn(true);
+		$this->tagManager->expects($this->never())
+			->method('deleteTags');
+		$this->tagMapper->expects($this->never())
+			->method('unassignTags');
+
+		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
+		$node->delete();
+	}
+
 	public function tagNodeDeleteProviderPermissionException() {
 		return [
 			[
@@ -144,8 +157,7 @@ public function testDeleteTagExpectedException(ISystemTag $tag, $expectedExcepti
 		$this->assertInstanceOf($expectedException, $thrown);
 	}
 
-	
-	public function testDeleteTagNotFound() {
+	public function testDeleteTagNotFound(): void {
 		$this->expectException(\Sabre\DAV\Exception\NotFound::class);
 
 		// assuming the tag existed at the time the node was created,
@@ -164,6 +176,6 @@ public function testDeleteTagNotFound() {
 			->with(123, 'files', 1)
 			->will($this->throwException(new TagNotFoundException()));
 
-		$this->getMappingNode($tag)->delete();
+		$this->getMappingNode($tag, [123])->delete();
 	}
 }
diff --git a/apps/dav/tests/unit/SystemTag/SystemTagsObjectMappingCollectionTest.php b/apps/dav/tests/unit/SystemTag/SystemTagsObjectMappingCollectionTest.php
index bb71de8ea8e85..d99ab2512cfcf 100644
--- a/apps/dav/tests/unit/SystemTag/SystemTagsObjectMappingCollectionTest.php
+++ b/apps/dav/tests/unit/SystemTag/SystemTagsObjectMappingCollectionTest.php
@@ -32,20 +32,11 @@
 use OCP\SystemTag\TagNotFoundException;
 
 class SystemTagsObjectMappingCollectionTest extends \Test\TestCase {
-
-	/**
-	 * @var \OCP\SystemTag\ISystemTagManager
-	 */
+	/** @var ISystemTagManager */
 	private $tagManager;
-
-	/**
-	 * @var \OCP\SystemTag\ISystemTagObjectMapper
-	 */
+	/** @var ISystemTagObjectMapper */
 	private $tagMapper;
-
-	/**
-	 * @var \OCP\IUser
-	 */
+	/** @var IUser */
 	private $user;
 
 	protected function setUp(): void {
@@ -60,13 +51,16 @@ protected function setUp(): void {
 			->getMock();
 	}
 
-	public function getNode() {
+	public function getNode(array $writableNodeIds = []) {
 		return new \OCA\DAV\SystemTag\SystemTagsObjectMappingCollection(
 			111,
 			'files',
 			$this->user,
 			$this->tagManager,
-			$this->tagMapper
+			$this->tagMapper,
+			function ($id) use ($writableNodeIds): bool {
+				return in_array($id, $writableNodeIds);
+			},
 		);
 	}
 
@@ -89,6 +83,28 @@ public function testAssignTag() {
 			->method('assignTags')
 			->with(111, 'files', '555');
 
+		$this->getNode([111])->createFile('555');
+	}
+
+	public function testAssignTagForbidden(): void {
+		$tag = new SystemTag('1', 'Test', true, true);
+		$this->tagManager->expects($this->once())
+			->method('canUserSeeTag')
+			->with($tag)
+			->willReturn(true);
+		$this->tagManager->expects($this->once())
+			->method('canUserAssignTag')
+			->with($tag)
+			->willReturn(true);
+
+		$this->tagManager->expects($this->once())
+			->method('getTagsByIds')
+			->with(['555'])
+			->willReturn([$tag]);
+		$this->tagMapper->expects($this->never())
+			->method('assignTags');
+
+		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
 		$this->getNode()->createFile('555');
 	}
 
@@ -132,8 +148,7 @@ public function testAssignTagNoPermission($userVisible, $userAssignable, $expect
 		$this->assertInstanceOf($expectedException, $thrown);
 	}
 
-	
-	public function testAssignTagNotFound() {
+	public function testAssignTagNotFound(): void {
 		$this->expectException(\Sabre\DAV\Exception\PreconditionFailed::class);
 
 		$this->tagManager->expects($this->once())
@@ -144,8 +159,7 @@ public function testAssignTagNotFound() {
 		$this->getNode()->createFile('555');
 	}
 
-	
-	public function testForbiddenCreateDirectory() {
+	public function testForbiddenCreateDirectory(): void {
 		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
 
 		$this->getNode()->createDirectory('789');
@@ -174,8 +188,7 @@ public function testGetChild() {
 		$this->assertEquals('555', $childNode->getName());
 	}
 
-	
-	public function testGetChildNonVisible() {
+	public function testGetChildNonVisible(): void {
 		$this->expectException(\Sabre\DAV\Exception\NotFound::class);
 
 		$tag = new SystemTag(555, 'TheTag', false, false);
@@ -197,8 +210,7 @@ public function testGetChildNonVisible() {
 		$this->getNode()->getChild('555');
 	}
 
-	
-	public function testGetChildRelationNotFound() {
+	public function testGetChildRelationNotFound(): void {
 		$this->expectException(\Sabre\DAV\Exception\NotFound::class);
 
 		$this->tagMapper->expects($this->once())
@@ -209,8 +221,7 @@ public function testGetChildRelationNotFound() {
 		$this->getNode()->getChild('777');
 	}
 
-	
-	public function testGetChildInvalidId() {
+	public function testGetChildInvalidId(): void {
 		$this->expectException(\Sabre\DAV\Exception\BadRequest::class);
 
 		$this->tagMapper->expects($this->once())
@@ -221,8 +232,7 @@ public function testGetChildInvalidId() {
 		$this->getNode()->getChild('badid');
 	}
 
-	
-	public function testGetChildTagDoesNotExist() {
+	public function testGetChildTagDoesNotExist(): void {
 		$this->expectException(\Sabre\DAV\Exception\NotFound::class);
 
 		$this->tagMapper->expects($this->once())
@@ -325,8 +335,7 @@ public function testChildExistsTagNotFound() {
 		$this->assertFalse($this->getNode()->childExists('555'));
 	}
 
-	
-	public function testChildExistsInvalidId() {
+	public function testChildExistsInvalidId(): void {
 		$this->expectException(\Sabre\DAV\Exception\BadRequest::class);
 
 		$this->tagMapper->expects($this->once())
@@ -337,15 +346,13 @@ public function testChildExistsInvalidId() {
 		$this->getNode()->childExists('555');
 	}
 
-	
-	public function testDelete() {
+	public function testDelete(): void {
 		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
 
 		$this->getNode()->delete();
 	}
 
-	
-	public function testSetName() {
+	public function testSetName(): void {
 		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
 
 		$this->getNode()->setName('somethingelse');
diff --git a/apps/dav/tests/unit/SystemTag/SystemTagsObjectTypeCollectionTest.php b/apps/dav/tests/unit/SystemTag/SystemTagsObjectTypeCollectionTest.php
index 11c9fc5977c8f..27140292642c7 100644
--- a/apps/dav/tests/unit/SystemTag/SystemTagsObjectTypeCollectionTest.php
+++ b/apps/dav/tests/unit/SystemTag/SystemTagsObjectTypeCollectionTest.php
@@ -33,7 +33,6 @@
 use OCP\SystemTag\ISystemTagObjectMapper;
 
 class SystemTagsObjectTypeCollectionTest extends \Test\TestCase {
-
 	/**
 	 * @var \OCA\DAV\SystemTag\SystemTagsObjectTypeCollection
 	 */
@@ -87,6 +86,15 @@ protected function setUp(): void {
 			$nodes = $userFolder->getById(intval($name));
 			return !empty($nodes);
 		};
+		$writeAccessClosure = function ($name) use ($userFolder) {
+			$nodes = $userFolder->getById((int)$name);
+			foreach ($nodes as $node) {
+				if (($node->getPermissions() & Constants::PERMISSION_UPDATE) === Constants::PERMISSION_UPDATE) {
+					return true;
+				}
+			}
+			return false;
+		};
 
 		$this->node = new \OCA\DAV\SystemTag\SystemTagsObjectTypeCollection(
 			'files',
@@ -94,19 +102,18 @@ protected function setUp(): void {
 			$this->tagMapper,
 			$userSession,
 			$groupManager,
-			$closure
+			$closure,
+			$writeAccessClosure,
 		);
 	}
 
-	
-	public function testForbiddenCreateFile() {
+	public function testForbiddenCreateFile(): void {
 		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
 
 		$this->node->createFile('555');
 	}
 
-	
-	public function testForbiddenCreateDirectory() {
+	public function testForbiddenCreateDirectory(): void {
 		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
 
 		$this->node->createDirectory('789');
@@ -123,8 +130,7 @@ public function testGetChild() {
 		$this->assertEquals('555', $childNode->getName());
 	}
 
-	
-	public function testGetChildWithoutAccess() {
+	public function testGetChildWithoutAccess(): void {
 		$this->expectException(\Sabre\DAV\Exception\NotFound::class);
 
 		$this->userFolder->expects($this->once())
@@ -134,8 +140,7 @@ public function testGetChildWithoutAccess() {
 		$this->node->getChild('555');
 	}
 
-	
-	public function testGetChildren() {
+	public function testGetChildren(): void {
 		$this->expectException(\Sabre\DAV\Exception\MethodNotAllowed::class);
 
 		$this->node->getChildren();
@@ -157,15 +162,13 @@ public function testChildExistsWithoutAccess() {
 		$this->assertFalse($this->node->childExists('555'));
 	}
 
-	
-	public function testDelete() {
+	public function testDelete(): void {
 		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
 
 		$this->node->delete();
 	}
 
-	
-	public function testSetName() {
+	public function testSetName(): void {
 		$this->expectException(\Sabre\DAV\Exception\Forbidden::class);
 
 		$this->node->setName('somethingelse');