EXOJCR-764: To definitively fix the issue I had to check the permission in SessionFactory.createSession What has been done: 1. Re-add the security test for the profile run-all 2. Move the permission check from RepositoryImpl.getSystemSession(..) to SessionFactory.createSession 3. The related unit test added 4. Fix the other tests 5. Renamed the permission "getJCRSystemSession" to "createSystemSession"