diff --git a/Changes b/Changes
index 7ad33f51..2eac3689 100644
--- a/Changes
+++ b/Changes
@@ -1,3 +1,9 @@
+2.036001 - 2017-06-22
+
+  [BUG FIXES]
+
+  * fix ACL content accepted by check_acl_*
+
 2.036000 - 2017-06-22
 
   [NEW FEATURES]
diff --git a/lib/App/Netdisco/Util/Permission.pm b/lib/App/Netdisco/Util/Permission.pm
index dd3f7940..5d87a7fc 100644
--- a/lib/App/Netdisco/Util/Permission.pm
+++ b/lib/App/Netdisco/Util/Permission.pm
@@ -40,7 +40,7 @@ C<$setting_name> can contain.
 sub check_acl_no {
   my ($thing, $setting_name) = @_;
   return 1 unless $thing and $setting_name;
-  return check_acl($thing, setting($setting_name));
+  return check_acl($thing, (setting($setting_name) || $setting_name));
 }
 
 =head2 check_acl_only( $ip | $instance, $setting_name )
@@ -58,7 +58,7 @@ sub check_acl_only {
   my ($thing, $setting_name) = @_;
   return 0 unless $thing and $setting_name;
   # logic to make an empty config be equivalent to 'any' (i.e. a match)
-  my $config = setting($setting_name);
+  my $config = (setting($setting_name) || $setting_name);
   return 1 if not $config # undef or empty string
               or ((ref [] eq ref $config) and not scalar @$config);
   return check_acl($thing, $config);