diff --git a/changelog.d/feat-edithtml-role-permission.md b/changelog.d/feat-edithtml-role-permission.md
new file mode 100644
index 000000000..d644a034f
--- /dev/null
+++ b/changelog.d/feat-edithtml-role-permission.md
@@ -0,0 +1 @@
+FEAT: The "editHtml" permission can now be granted to roles via the role management GUI, instead of only being available to administrators (#452)
diff --git a/share/server/core/classes/CoreAuthorisationHandler.php b/share/server/core/classes/CoreAuthorisationHandler.php
index a00d39e4c..caf666913 100644
--- a/share/server/core/classes/CoreAuthorisationHandler.php
+++ b/share/server/core/classes/CoreAuthorisationHandler.php
@@ -63,7 +63,6 @@ class CoreAuthorisationHandler
             'createObject' => 'edit',
             'deleteObject' => 'edit',
             'addModify' => 'edit',
-            'editHtml' => 'edit',
         ],
         'Overview' => [
             'getOverviewRotations' => 'view',
diff --git a/share/server/core/classes/CorePDOHandler.php b/share/server/core/classes/CorePDOHandler.php
index 10eeb9a91..26093b6ae 100644
--- a/share/server/core/classes/CorePDOHandler.php
+++ b/share/server/core/classes/CorePDOHandler.php
@@ -174,6 +174,10 @@ public static function initialize_static()
                 ],
 
                 'updates' => [
+                    '1100500' => [
+                        ['-perm-add', ['mod' => 'Map', 'act' => 'editHtml', 'obj' => '*']],
+                    ],
+
                     '1091500' => [
                         ['-perm-change-act', ['mod' => 'ChangePassword', 'old_act' => 'change', 'new_act' => '*']]
                     ],
@@ -830,6 +834,10 @@ public function createInitialDb()
         $this->queryFatal('-perm-add', ['mod' => 'Map', 'act' => 'manage', 'obj' => '*']);
         $this->queryFatal('-perm-add', ['mod' => 'Map', 'act' => 'add', 'obj' => '*']);
 
+        // Access controll: Edit HTML content of map objects, grantable via the
+        // role management GUI (CVE-2024-47090)
+        $this->queryFatal('-perm-add', ['mod' => 'Map', 'act' => 'editHtml', 'obj' => '*']);
+
         $this->queryFatal('-perm-add', ['mod' => 'MainCfg', 'act' => 'edit', 'obj' => '*']);
 
         // Access control: View URLs e.g. in rotation pools
diff --git a/share/server/core/classes/ViewManageRoles.php b/share/server/core/classes/ViewManageRoles.php
index 3f3ad89c4..742723637 100644
--- a/share/server/core/classes/ViewManageRoles.php
+++ b/share/server/core/classes/ViewManageRoles.php
@@ -205,7 +205,12 @@ private function renderPermissions($role_id)
             'rotations' => [],
         ];
         foreach ($AUTHORISATION->getAllVisiblePerms() as $perm) {
-            if ($perm['mod'] == 'Map' && $perm['act'] != 'add' && $perm['act'] != 'manage') {
+            if (
+                $perm['mod'] == 'Map'
+                && $perm['act'] != 'add'
+                && $perm['act'] != 'manage'
+                && $perm['act'] != 'editHtml'
+            ) {
                 $map_name = $perm['obj'];
                 if (!isset($permissions_by_section['maps'][$map_name])) {
                     $permissions_by_section['maps'][$map_name] = [];