diff --git a/radicale/app/proppatch.py b/radicale/app/proppatch.py
index dc4721e2..40646839 100644
--- a/radicale/app/proppatch.py
+++ b/radicale/app/proppatch.py
@@ -20,6 +20,7 @@
 # along with Radicale.  If not, see <http://www.gnu.org/licenses/>.
 
 import errno
+import logging
 import re
 import socket
 import xml.etree.ElementTree as ET
@@ -113,23 +114,27 @@ class ApplicationPartProppatch(ApplicationBase):
                 permissions_filter = share['Permissions']
         access = Access(self._rights, user, path, permissions_filter)
         if not access.check("w"):
-            logger.debug("TRACE/PROPPATCH/xml_proppatch: no write-access: %r", path)
+            logger.debug("TRACE/PROPPATCH/xml_proppatch: no native write-access: %r", path)
             if share:
-                # no write access -> use properties overlay
-                if self._sharing.permit_properties_overlay:
-                    if permissions_filter is not None and "p" in permissions_filter:
-                        logger.info("PROPPATCH request on shared %r: no write-permissions, overlay permitted, but denied by permission 'p'", path_orig)
-                        return httputils.NOT_ALLOWED
+                # priority share->rights->global
+                raw_permissions = self._rights.authorization(user, path)
+                if logger.isEnabledFor(logging.DEBUG):
+                    logger.debug("TRACE/PROPPATCH/share: raw_permissions=%r share[Permissions]=%r permit_properties_overlay=%s", raw_permissions, share['Permissions'], self._sharing.permit_properties_overlay)
+                if ("P" in share['Permissions'] or
+                        ("P" in raw_permissions and "p" not in share['Permissions']) or
+                        (self._sharing.permit_properties_overlay and "p" not in raw_permissions and "p" not in share['Permissions'])
+                    ) and not (
+                            "p" in share['Permissions'] or
+                            ("p" in raw_permissions and "P" not in share['Permissions']) or
+                            (self._sharing.permit_properties_overlay and "P" not in raw_permissions and "P" not in share['Permissions'])):
+                    logger.info("PROPPATCH request on shared %r: write-access", path_orig)
+                    if permissions_filter is not None and "e" in permissions_filter:
+                        logger.info("PROPPATCH request on shared %r: write-access, overlay enforced, but disabled by permission 'e'", path_orig)
                     else:
-                        logger.info("PROPPATCH request on shared %r: no write-permissions, overlay permitted by option", path_orig)
                         share_overlay = True
                 else:
-                    if permissions_filter is not None and "P" in permissions_filter:
-                        logger.info("PROPPATCH request on shared %r: no write-permissions, overlay denied, but granted by permission 'P'", path_orig)
-                        share_overlay = True
-                    else:
-                        logger.info("PROPPATCH request on shared %r: no write-permissions and overlay denied by option", path_orig)
-                        return httputils.NOT_ALLOWED
+                    logger.info("PROPPATCH request on shared %r: no write-access", path_orig)
+                    return httputils.NOT_ALLOWED
             else:
                 return httputils.NOT_ALLOWED
         else: