diff --git a/scm-core/src/main/java/sonia/scm/repository/Repository.java b/scm-core/src/main/java/sonia/scm/repository/Repository.java
index 5bb50db06f..8c7000c25a 100644
--- a/scm-core/src/main/java/sonia/scm/repository/Repository.java
+++ b/scm-core/src/main/java/sonia/scm/repository/Repository.java
@@ -82,7 +82,7 @@ public class Repository extends BasicPropertiesAware implements ModelObject, Per
   private String namespace;
   private String name;
   @XmlElement(name = "permission")
-  private final Set<RepositoryPermission> permissions = new HashSet<>();
+  private Set<RepositoryPermission> permissions = new HashSet<>();
   @XmlElement(name = "public")
   private boolean publicReadable = false;
   private boolean archived = false;
@@ -331,6 +331,8 @@ public class Repository extends BasicPropertiesAware implements ModelObject, Per
 
     try {
       repository = (Repository) super.clone();
+      // fix permission reference on clone
+      repository.permissions = new HashSet<>(permissions);
     } catch (CloneNotSupportedException ex) {
       throw new RuntimeException(ex);
     }
diff --git a/scm-core/src/test/java/sonia/scm/repository/RepositoryTest.java b/scm-core/src/test/java/sonia/scm/repository/RepositoryTest.java
new file mode 100644
index 0000000000..6053e10ad5
--- /dev/null
+++ b/scm-core/src/test/java/sonia/scm/repository/RepositoryTest.java
@@ -0,0 +1,22 @@
+package sonia.scm.repository;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.Arrays;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class RepositoryTest {
+
+  @Test
+  void shouldCreateNewPermissionOnClone() {
+    Repository repository = new Repository();
+    repository.setPermissions(Arrays.asList(new RepositoryPermission("one", "role", false)));
+
+    Repository cloned = repository.clone();
+    cloned.setPermissions(Arrays.asList(new RepositoryPermission("two", "role", false)));
+
+    assertThat(repository.getPermissions()).extracting(r -> r.getName()).containsOnly("one");
+  }
+
+}