diff --git a/src/backend/src/services/auth/ACLService.js b/src/backend/src/services/auth/ACLService.js
index 9edd85cce..a036983e1 100644
--- a/src/backend/src/services/auth/ACLService.js
+++ b/src/backend/src/services/auth/ACLService.js
@@ -56,9 +56,11 @@ class ACLService extends BaseService {
         }
         
         // Hard rule: anyone and anything can read /user/public directories
-        const public_modes = ['read', 'list', 'see'];
-        if ( public_modes.includes(mode) ) {
-            if ( await fsNode.isPublic() ) return true;
+        if ( this.global_config.enable_public_folders ) {
+            const public_modes = ['read', 'list', 'see'];
+            if ( public_modes.includes(mode) ) {
+                if ( await fsNode.isPublic() ) return true;
+            }
         }
 
         // Access tokens only work if the authorizer has permission