diff --git a/backend/src/services/app-connection/app-connection-service.ts b/backend/src/services/app-connection/app-connection-service.ts
index 19d66b9fd..a3841e68a 100644
--- a/backend/src/services/app-connection/app-connection-service.ts
+++ b/backend/src/services/app-connection/app-connection-service.ts
@@ -266,9 +266,9 @@ export const appConnectionServiceFactory = ({
       const { permission } = await permissionService.getOrgPermission(
         actor.type,
         actor.id,
-        actor.orgId,
+        appConnection.orgId,
         actor.authMethod,
-        appConnection.orgId
+        actor.orgId
       );
 
       ForbiddenError.from(permission).throwUnlessCan(
@@ -316,9 +316,9 @@ export const appConnectionServiceFactory = ({
       const { permission } = await permissionService.getOrgPermission(
         actor.type,
         actor.id,
-        actor.orgId,
+        appConnection.orgId,
         actor.authMethod,
-        appConnection.orgId
+        actor.orgId
       );
 
       ForbiddenError.from(permission).throwUnlessCan(
@@ -475,9 +475,9 @@ export const appConnectionServiceFactory = ({
     const { permission: orgPermission } = await permissionService.getOrgPermission(
       actor.type,
       actor.id,
-      actor.orgId,
+      appConnection.orgId,
       actor.authMethod,
-      appConnection.orgId
+      actor.orgId
     );
 
     if (appConnection.projectId) {
@@ -633,9 +633,9 @@ export const appConnectionServiceFactory = ({
       const { permission } = await permissionService.getOrgPermission(
         actor.type,
         actor.id,
-        actor.orgId,
+        appConnection.orgId,
         actor.authMethod,
-        appConnection.orgId
+        actor.orgId
       );
 
       ForbiddenError.from(permission).throwUnlessCan(
@@ -803,9 +803,9 @@ export const appConnectionServiceFactory = ({
     const { permission } = await permissionService.getOrgPermission(
       actor.type,
       actor.id,
-      actor.orgId,
+      appConnection.orgId,
       actor.authMethod,
-      appConnection.orgId
+      actor.orgId
     );
 
     ForbiddenError.from(permission).throwUnlessCan(