diff --git a/src/Umbraco.Core/Services/UserServiceExtensions.cs b/src/Umbraco.Core/Services/UserServiceExtensions.cs
index f17a266616..7399f37fe8 100644
--- a/src/Umbraco.Core/Services/UserServiceExtensions.cs
+++ b/src/Umbraco.Core/Services/UserServiceExtensions.cs
@@ -8,6 +8,11 @@ namespace Umbraco.Extensions;
 public static class UserServiceExtensions
 {
     public static EntityPermission? GetPermissions(this IUserService userService, IUser? user, string path)
+    {
+       return userService.GetAllPermissions(user, path).FirstOrDefault();
+    }
+
+    public static EntityPermissionCollection GetAllPermissions(this IUserService userService, IUser? user, string path)
     {
         var ids = path.Split(Constants.CharArrays.Comma, StringSplitOptions.RemoveEmptyEntries)
             .Select(x =>
@@ -23,7 +28,7 @@ public static class UserServiceExtensions
                                                 " could not be parsed into an array of integers or the path was empty");
         }
 
-        return userService.GetPermissions(user, ids[^1]).FirstOrDefault();
+        return userService.GetPermissions(user, ids[^1]);
     }
 
     /// <summary>
diff --git a/src/Umbraco.PublishedCache.NuCache/Persistence/NuCacheContentRepository.cs b/src/Umbraco.PublishedCache.NuCache/Persistence/NuCacheContentRepository.cs
index af8c46821f..f54158dac1 100644
--- a/src/Umbraco.PublishedCache.NuCache/Persistence/NuCacheContentRepository.cs
+++ b/src/Umbraco.PublishedCache.NuCache/Persistence/NuCacheContentRepository.cs
@@ -224,7 +224,7 @@ AND cmsContentNu.nodeId IS NULL
         IContentCacheDataSerializer serializer =
             _contentCacheDataSerializerFactory.Create(ContentCacheDataSerializerEntityType.Document);
 
-        IEnumerable<ContentSourceDto> dtos = GetContentNodeDtos(sql);
+        IEnumerable<ContentSourceDto> dtos = GetContentNodeDtos(sql, Constants.ObjectTypes.Document);
 
         foreach (ContentSourceDto row in dtos)
         {
@@ -242,7 +242,7 @@ AND cmsContentNu.nodeId IS NULL
         IContentCacheDataSerializer serializer =
             _contentCacheDataSerializerFactory.Create(ContentCacheDataSerializerEntityType.Document);
 
-        IEnumerable<ContentSourceDto> dtos = GetContentNodeDtos(sql);
+        IEnumerable<ContentSourceDto> dtos = GetContentNodeDtos(sql, Constants.ObjectTypes.Document);
 
         foreach (ContentSourceDto row in dtos)
         {
@@ -265,7 +265,7 @@ AND cmsContentNu.nodeId IS NULL
         IContentCacheDataSerializer serializer =
             _contentCacheDataSerializerFactory.Create(ContentCacheDataSerializerEntityType.Document);
 
-        IEnumerable<ContentSourceDto> dtos = GetContentNodeDtos(sql);
+        IEnumerable<ContentSourceDto> dtos = GetContentNodeDtos(sql, Constants.ObjectTypes.Document);
 
         foreach (ContentSourceDto row in dtos)
         {
@@ -301,7 +301,7 @@ AND cmsContentNu.nodeId IS NULL
         IContentCacheDataSerializer serializer =
             _contentCacheDataSerializerFactory.Create(ContentCacheDataSerializerEntityType.Media);
 
-        IEnumerable<ContentSourceDto> dtos = GetContentNodeDtos(sql);
+        IEnumerable<ContentSourceDto> dtos = GetContentNodeDtos(sql, Constants.ObjectTypes.Media);
 
         foreach (ContentSourceDto row in dtos)
         {
@@ -319,7 +319,7 @@ AND cmsContentNu.nodeId IS NULL
         IContentCacheDataSerializer serializer =
             _contentCacheDataSerializerFactory.Create(ContentCacheDataSerializerEntityType.Media);
 
-        IEnumerable<ContentSourceDto> dtos = GetContentNodeDtos(sql);
+        IEnumerable<ContentSourceDto> dtos = GetContentNodeDtos(sql, Constants.ObjectTypes.Media);
 
         foreach (ContentSourceDto row in dtos)
         {
@@ -342,7 +342,7 @@ AND cmsContentNu.nodeId IS NULL
         IContentCacheDataSerializer serializer =
             _contentCacheDataSerializerFactory.Create(ContentCacheDataSerializerEntityType.Media);
 
-        IEnumerable<ContentSourceDto> dtos = GetContentNodeDtos(sql);
+        IEnumerable<ContentSourceDto> dtos = GetContentNodeDtos(sql, Constants.ObjectTypes.Media);
 
         foreach (ContentSourceDto row in dtos)
         {
@@ -990,7 +990,7 @@ WHERE cmsContentNu.nodeId IN (
         return s;
     }
 
-    private IEnumerable<ContentSourceDto> GetContentNodeDtos(Sql<ISqlContext> sql)
+    private IEnumerable<ContentSourceDto> GetContentNodeDtos(Sql<ISqlContext> sql, Guid nodeObjectType)
     {
         // We need to page here. We don't want to iterate over every single row in one connection cuz this can cause an SQL Timeout.
         // We also want to read with a db reader and not load everything into memory, QueryPaged lets us do that.
@@ -1000,7 +1000,7 @@ WHERE cmsContentNu.nodeId IN (
         {
             // Use a more efficient COUNT query
             Sql<ISqlContext>? sqlCountQuery = SqlContentSourcesCount()
-                .Append(SqlObjectTypeNotTrashed(SqlContext, Constants.ObjectTypes.Document));
+                .Append(SqlObjectTypeNotTrashed(SqlContext, nodeObjectType));
 
             Sql<ISqlContext>? sqlCount =
                 SqlContext.Sql("SELECT COUNT(*) FROM (").Append(sqlCountQuery).Append(") npoco_tbl");
diff --git a/src/Umbraco.Web.BackOffice/Controllers/ContentController.cs b/src/Umbraco.Web.BackOffice/Controllers/ContentController.cs
index 9ec67319d9..f41a5e4c3a 100644
--- a/src/Umbraco.Web.BackOffice/Controllers/ContentController.cs
+++ b/src/Umbraco.Web.BackOffice/Controllers/ContentController.cs
@@ -2337,11 +2337,11 @@ public class ContentController : ContentControllerBase
             return NotFound("There is no content node with id {model.NodeId}.");
         }
 
-        EntityPermission? permission =
-            _userService.GetPermissions(_backofficeSecurityAccessor.BackOfficeSecurity?.CurrentUser, node.Path);
+        // Validate permissions on node
+        var permissions = _userService.GetAllPermissions(_backofficeSecurityAccessor.BackOfficeSecurity?.CurrentUser, node.Path);
 
-
-        if (permission?.AssignedPermissions.Contains(ActionAssignDomain.ActionLetter.ToString(), StringComparer.Ordinal) == false)
+        if (permissions.Any(x =>
+                x.AssignedPermissions.Contains(ActionAssignDomain.ActionLetter.ToString(), StringComparer.Ordinal) && x.EntityId == node.Id) == false)
         {
             HttpContext.SetReasonPhrase("Permission Denied.");
             return BadRequest("You do not have permission to assign domains on that node.");