diff --git a/api.php b/api.php
index cc576e6..8e776c7 100644
--- a/api.php
+++ b/api.php
@@ -228,6 +228,31 @@ switch ($VARS['action']) {
         $data = $database->select('accounts', ['uid', 'username', 'realname (name)'], ["OR" => ['username[~]' => $VARS['search'], 'realname[~]' => $VARS['search']], "LIMIT" => 10]);
         exit(json_encode(["status" => "OK", "result" => $data]));
         break;
+    case "permission":
+        if (is_empty($VARS['code'])) {
+            header("HTTP/1.1 400 Bad Request");
+            die("\"400 Bad Request\"");
+        }
+        $perm = $VARS['code'];
+        if ($VARS['uid']) {
+            if ($database->has("accounts", ['uid' => $VARS['uid']])) {
+                $user = $database->select('accounts', ['username'], ['uid' => $VARS['uid']])[0]['username'];
+            } else {
+                exit(json_encode(["status" => "ERROR", "msg" => lang("user does not exist", false)]));
+            }
+        } else if ($VARS['username']) {
+            if ($database->has("accounts", ['username' => $VARS['username']])) {
+                $user = $VARS['username'];
+            } else {
+                exit(json_encode(["status" => "ERROR", "msg" => lang("user does not exist", false)]));
+            }
+        } else {
+            header("HTTP/1.1 400 Bad Request");
+            die("\"400 Bad Request\"");
+        }
+        $hasperm = account_has_permission($user, $perm);
+        exit(json_encode(["status" => "OK", "has_permission" => $hasperm]));
+        break;
     default:
         header("HTTP/1.1 400 Bad Request");
         die("\"400 Bad Request\"");
diff --git a/database.mwb b/database.mwb
index ed03363..1c75402 100644
Binary files a/database.mwb and b/database.mwb differ
diff --git a/lib/login.php b/lib/login.php
index c887f5f..223f8ed 100644
--- a/lib/login.php
+++ b/lib/login.php
@@ -236,6 +236,25 @@ function get_account_status($username, &$error) {
     }
 }
 
+/**
+ * Check if the given username has the given permission (or admin access)
+ * @global $database $database
+ * @param string $username
+ * @param string $permcode
+ * @return boolean TRUE if the user has the permission (or admin access), else FALSE
+ */
+function account_has_permission($username, $permcode) {
+    global $database;
+    return $database->has('assigned_permissions', [
+                '[>]accounts' => [
+                    'uid' => 'uid'
+                ],
+                '[>]permissions' => [
+                    'permid' => 'permid'
+                ]
+                    ], ['AND' => ['OR' => ['permcode' => $permcode, 'permcode' => 'ADMIN'], 'username' => $username]]) === TRUE;
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 //                              Login handling                                //
 ////////////////////////////////////////////////////////////////////////////////