diff --git a/CHANGELOG b/CHANGELOG
index 1d8446744a4e53ee3c341574b278ed3e94b5bec7..7104282e37885b8422f0ca88c8fb67aed61e5635 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -15,6 +15,8 @@ minerva (14.0.0~beta.2) unstable; urgency=low
   * Bug fix: version of the project is limited to 20 characters (#951)
   * Bug fix: link to comment on map from admin panel was broken (#941)
   * Bug fix: hide glyphs tab when necessary (#949)
+  * Bug fix: user with write access but without can_create_privileges cannot
+    create data overlay (#939)
 
  -- Piotr Gawron <piotr.gawron@uni.lu>  Mon, 16 Sep 2019 21:00:00 +0200
 
diff --git a/rest-api/src/main/java/lcsb/mapviewer/api/projects/overlays/OverlayController.java b/rest-api/src/main/java/lcsb/mapviewer/api/projects/overlays/OverlayController.java
index a39ed1b5687428b41c12a8cc8c801d523c5dffb6..7cfd280fc1d4f4f8f510f2ee985f8fad9a6b1c0d 100644
--- a/rest-api/src/main/java/lcsb/mapviewer/api/projects/overlays/OverlayController.java
+++ b/rest-api/src/main/java/lcsb/mapviewer/api/projects/overlays/OverlayController.java
@@ -37,7 +37,8 @@ public class OverlayController extends BaseController {
   public List<Map<String, Object>> getOverlayList(
       @PathVariable(value = "projectId") String projectId,
       @RequestParam(value = "creator", defaultValue = "") String creator,
-      @RequestParam(value = "publicOverlay", defaultValue = "false") boolean publicOverlay) throws lcsb.mapviewer.api.ObjectNotFoundException {
+      @RequestParam(value = "publicOverlay", defaultValue = "false") boolean publicOverlay)
+      throws lcsb.mapviewer.api.ObjectNotFoundException {
     return overlayRestImp.getOverlayList(projectId).stream()
         .filter(overlay -> !publicOverlay || (Boolean) overlay.get("publicOverlay"))
         .filter(
@@ -99,7 +100,8 @@ public class OverlayController extends BaseController {
         Integer.valueOf(reactionId), "ALIAS", columns);
   }
 
-  @PreAuthorize("hasAnyAuthority('IS_ADMIN', 'WRITE_PROJECT:' + #projectId)" +
+  @PreAuthorize("hasAuthority('IS_ADMIN')" +
+      " or (hasAuthority('IS_CURATOR') and hasAuthority('WRITE_PROJECT:' + #projectId))" +
       " or (hasAuthority('READ_PROJECT:' + #projectId) and hasAuthority('CAN_CREATE_OVERLAYS'))")
   @PostMapping(value = "/")
   public Map<String, Object> addOverlay(
diff --git a/web/src/test/java/lcsb/mapviewer/web/OverlayControllerIntegrationTest.java b/web/src/test/java/lcsb/mapviewer/web/OverlayControllerIntegrationTest.java
index 67b26e67e10ca3c106a840394bbe09ca7370cb36..11839fc471841ce28451344588980e80c4a9c623 100644
--- a/web/src/test/java/lcsb/mapviewer/web/OverlayControllerIntegrationTest.java
+++ b/web/src/test/java/lcsb/mapviewer/web/OverlayControllerIntegrationTest.java
@@ -1246,4 +1246,31 @@ public class OverlayControllerIntegrationTest extends ControllerIntegrationTest
     assertEquals(3, overlay4.getOrderIndex());
   }
 
+  @Test
+  public void testCreateOverlayWithoutCreateDataOverlayAccess() throws Exception {
+    User user = createUser(TEST_USER_LOGIN, TEST_USER_PASSWORD);
+    userService.grantUserPrivilege(user, PrivilegeType.WRITE_PROJECT, project.getProjectId());
+
+    UploadedFileEntry file = createFile("elementIdentifier\tvalue\n\t-1", user);
+
+    MockHttpSession session = createSession(TEST_USER_LOGIN, TEST_USER_PASSWORD);
+
+    String body = EntityUtils.toString(new UrlEncodedFormEntity(Arrays.asList(
+        new BasicNameValuePair("fileId", String.valueOf(file.getId())),
+        new BasicNameValuePair("name", "overlay name"),
+        new BasicNameValuePair("description", "overlay name"),
+        new BasicNameValuePair("filename", "overlay name"),
+        new BasicNameValuePair("googleLicenseConsent", "overlay name"),
+        new BasicNameValuePair("type", "GENERIC"))));
+
+    RequestBuilder request = post("/projects/"+TEST_PROJECT+"/overlays/")
+        .contentType(MediaType.APPLICATION_FORM_URLENCODED)
+        .content(body)
+        .session(session);
+
+    mockMvc.perform(request)
+        .andExpect(status().isForbidden());
+  }
+
+
 }