diff --git a/pydatalab/pydatalab/routes/v0_1/collections.py b/pydatalab/pydatalab/routes/v0_1/collections.py
index 6d18e4a50..31b13dfcf 100644
--- a/pydatalab/pydatalab/routes/v0_1/collections.py
+++ b/pydatalab/pydatalab/routes/v0_1/collections.py
@@ -341,7 +341,7 @@ def add_items_to_collection(collection_id):
     if not refcodes:
         return jsonify({"error": "No item provided"}), 400
 
-    item_count = flask_mongo.db.items.count_documents({"refcode": {"$in": refcodes}})
+    item_count = flask_mongo.db.items.count_documents({"refcode": {"$in": refcodes}, **get_default_permissions()})
 
     if item_count == 0:
         return jsonify({"error": "No matching items found"}), 404