diff --git a/remote-api/src/main/java/org/alfresco/rest/api/impl/GroupsImpl.java b/remote-api/src/main/java/org/alfresco/rest/api/impl/GroupsImpl.java
index d291b1293b..fd67f5e9aa 100644
--- a/remote-api/src/main/java/org/alfresco/rest/api/impl/GroupsImpl.java
+++ b/remote-api/src/main/java/org/alfresco/rest/api/impl/GroupsImpl.java
@@ -147,7 +147,7 @@ public class GroupsImpl implements Groups
         }
 
         Map<QName, Serializable> props = new HashMap<>();
-        if (StringUtils.isNotEmpty(group.getDescription()))
+        if (group.getDescription() != null)
         {
             props.put(ContentModel.PROP_DESCRIPTION, group.getDescription());
         }
@@ -170,7 +170,7 @@ public class GroupsImpl implements Groups
 
         try
         {
-            if (StringUtils.isNotEmpty(group.getDescription()))
+            if (group.getDescription() != null)
             {
                 authorityService.setAuthorityDisplayNameAndDescription(groupId, group.getDisplayName(), group.getDescription());
             }
diff --git a/repository/src/main/java/org/alfresco/repo/security/permissions/impl/acegi/ACLEntryAfterInvocationProvider.java b/repository/src/main/java/org/alfresco/repo/security/permissions/impl/acegi/ACLEntryAfterInvocationProvider.java
index 9185cfa0f8..b80ff0a3ea 100644
--- a/repository/src/main/java/org/alfresco/repo/security/permissions/impl/acegi/ACLEntryAfterInvocationProvider.java
+++ b/repository/src/main/java/org/alfresco/repo/security/permissions/impl/acegi/ACLEntryAfterInvocationProvider.java
@@ -269,7 +269,18 @@ public class ACLEntryAfterInvocationProvider implements AfterInvocationProvider,
             }
             else if (Pair.class.isAssignableFrom(returnedObject.getClass()))
             {
-                return decide(authentication, object, config, (Pair) returnedObject);
+                Pair<?, ?> pair = (Pair<?, ?>) returnedObject;
+                if (pair.getSecond() != null && NodeRef.class.isAssignableFrom(pair.getSecond().getClass()))
+                {
+                    return decide(authentication, object, config, pair);
+                } else
+                {
+                    if (log.isDebugEnabled())
+                    {
+                        log.debug("Uncontrolled object - access allowed for " + object.getClass().getName());
+                    }
+                    return returnedObject;
+                }
             }
             else if (ChildAssociationRef.class.isAssignableFrom(returnedObject.getClass()))
             {