--- a/src/main/java/de/intevation/lada/util/auth/HeaderAuthorization.java	Mon Nov 07 10:51:28 2016 +0100
+++ b/src/main/java/de/intevation/lada/util/auth/HeaderAuthorization.java	Mon Nov 07 11:06:23 2016 +0100
@@ -17,17 +17,16 @@
 import javax.persistence.EntityManager;
 import javax.servlet.http.HttpServletRequest;
 
-import org.apache.log4j.Logger;
-
 import de.intevation.lada.model.land.KommentarM;
 import de.intevation.lada.model.land.KommentarP;
+import de.intevation.lada.model.land.Messprogramm;
+import de.intevation.lada.model.land.MessprogrammMmt;
 import de.intevation.lada.model.land.Messung;
 import de.intevation.lada.model.land.Messwert;
 import de.intevation.lada.model.land.Ortszuordnung;
 import de.intevation.lada.model.land.Probe;
 import de.intevation.lada.model.land.StatusProtokoll;
 import de.intevation.lada.model.land.ZusatzWert;
-import de.intevation.lada.model.land.Messprogramm;
 import de.intevation.lada.model.stammdaten.Auth;
 import de.intevation.lada.model.stammdaten.DatensatzErzeuger;
 import de.intevation.lada.model.stammdaten.LadaUser;
@@ -84,6 +83,7 @@
         authorizers.put(MessprogrammKategorie.class, netzAuthorizer);
         authorizers.put(Ort.class, netzAuthorizer);
         authorizers.put(Messprogramm.class, messprogrammAuthorizer);
+        authorizers.put(MessprogrammMmt.class, messprogrammAuthorizer);
     }
 
     /**

--- a/src/main/java/de/intevation/lada/util/auth/MessprogrammAuthorizer.java	Mon Nov 07 10:51:28 2016 +0100
+++ b/src/main/java/de/intevation/lada/util/auth/MessprogrammAuthorizer.java	Mon Nov 07 11:06:23 2016 +0100
@@ -7,15 +7,22 @@
  */
 package de.intevation.lada.util.auth;
 
-import java.util.ArrayList;
-import java.util.List;
+import javax.inject.Inject;
 
 import de.intevation.lada.model.land.Messprogramm;
+import de.intevation.lada.model.land.MessprogrammMmt;
+import de.intevation.lada.util.annotation.RepositoryConfig;
+import de.intevation.lada.util.data.Repository;
+import de.intevation.lada.util.data.RepositoryType;
 import de.intevation.lada.util.rest.RequestMethod;
 import de.intevation.lada.util.rest.Response;
 
 public class MessprogrammAuthorizer implements Authorizer {
 
+    @Inject
+    @RepositoryConfig(type=RepositoryType.RO)
+    private Repository repository;
+
     @Override
     public <T> boolean isAuthorized(
         Object data,
@@ -27,7 +34,16 @@
             // Allow read access to everybody
             return true;
         }
-        Messprogramm messprogramm = (Messprogramm)data;
+        Messprogramm messprogramm = null;
+        if (data instanceof Messprogramm) {
+            messprogramm = (Messprogramm)data;
+        }
+        else if (data instanceof MessprogrammMmt) {
+            messprogramm = repository.getByIdPlain(
+                Messprogramm.class,
+                ((MessprogrammMmt)data).getMessprogrammId(),
+                "land");
+        }
         if (userInfo.getMessstellen().contains(messprogramm.getMstId())) {
             return true;
         }