Merge pull request #5796 from timothestoifl24/claude/nifty-neumann-83e87c

Fix missing `new` on PermissionError so denied requests return 403, not 404

backend/lib/access.js

@@ -268,7 +268,7 @@ export default function (tokenString) {
 				err.permission = permission;
 				err.permission_data = data;
 				logger.error(permission, data, err.message);
-				throw errs.PermissionError("Permission Denied", err);
+				throw new errs.PermissionError("Permission Denied", err);
 			}
 		},
 	};