diff --git a/pkg/auth/auth.go b/pkg/auth/auth.go
index 09c6c0ed3..3290796aa 100644
--- a/pkg/auth/auth.go
+++ b/pkg/auth/auth.go
@@ -272,7 +272,7 @@ func IsLocalhost(req *http.Request) bool {
 // Allowed returns whether the given request
 // has access to perform all the operations in op.
 func Allowed(req *http.Request, op Operation) bool {
-	if op|OpUpload != 0 {
+	if op&OpUpload != 0 {
 		// upload (at least from camput) requires stat and get too
 		op = op | OpVivify
 	}