diff --git a/lib/acl.js b/lib/acl.js
index 78cb1a44f..30d6800c5 100644
--- a/lib/acl.js
+++ b/lib/acl.js
@@ -256,6 +256,11 @@ function possibleACLs (uri, suffix) {
   }
 
   var times = parsedUri.pathname.split('/').length
+  // TODO: improve temporary solution to stop recursive path walking above root
+  if (parsedUri.pathname.endsWith('/')) {
+    times--
+  }
+
   for (var i = 0; i < times - 1; i++) {
     uri = path.dirname(uri)
     urls.push(uri + (uri[uri.length - 1] === '/' ? suffix : '/' + suffix))