diff --git a/lib/Db/MultiTenancyTrait.php b/lib/Db/MultiTenancyTrait.php
index c8a537f73..33f43b5ff 100644
--- a/lib/Db/MultiTenancyTrait.php
+++ b/lib/Db/MultiTenancyTrait.php
@@ -693,6 +693,11 @@ protected function hasRbacPermission(string $action, string $entityType): bool
 
         $activeOrg = $this->organisationService->getActiveOrganisation();
         if ($activeOrg === null) {
+            // CLI context — no active organisation is expected. Allow access.
+            if (PHP_SAPI === 'cli') {
+                return true;
+            }
+
             // No active organisation, deny access.
             return false;
         }
@@ -717,6 +722,12 @@ protected function hasRbacPermission(string $action, string $entityType): bool
 
         $user = $this->userSession->getUser();
         if ($user === null) {
+            // CLI context (occ commands, repair steps, cron jobs) — no user session exists.
+            // These are trusted system operations that must always succeed.
+            if (PHP_SAPI === 'cli') {
+                return true;
+            }
+
             return false;
         }