diff --git a/lib/private/appframework/middleware/security/securitymiddleware.php b/lib/private/appframework/middleware/security/securitymiddleware.php
index 948a43ce0f4f523f16fa1ede4bca8a9b98b78791..0a694318634fa1b798037fcbf62daf90febbc734 100644
--- a/lib/private/appframework/middleware/security/securitymiddleware.php
+++ b/lib/private/appframework/middleware/security/securitymiddleware.php
@@ -34,6 +34,7 @@ use OCP\INavigationManager;
 use OCP\IURLGenerator;
 use OCP\IRequest;
 use OCP\ILogger;
+use OCP\AppFramework\Controller;
 
 
 /**
@@ -116,6 +117,16 @@ class SecurityMiddleware extends Middleware {
 			}
 		}
 
+		/**
+		 * FIXME: Use DI once available
+		 * Checks if app is enabled (also inclues a check whether user is allowed to access the resource)
+		 * The getAppPath() check is here since components such as settings also use the AppFramework and
+		 * therefore won't pass this check.
+		 */
+		if(\OC_App::getAppPath($this->appName) !== false && !\OC_App::isEnabled($this->appName)) {
+			throw new SecurityException('App is not enabled', Http::STATUS_PRECONDITION_FAILED);
+		}
+
 	}
 
 
diff --git a/tests/lib/appframework/middleware/security/SecurityMiddlewareTest.php b/tests/lib/appframework/middleware/security/SecurityMiddlewareTest.php
index 74fc7907fb58ab059816a5826864a6b1e399b4c1..cc7704f4d1a2744d80caac190636ea61718771a2 100644
--- a/tests/lib/appframework/middleware/security/SecurityMiddlewareTest.php
+++ b/tests/lib/appframework/middleware/security/SecurityMiddlewareTest.php
@@ -77,7 +77,7 @@ class SecurityMiddlewareTest extends \PHPUnit_Framework_TestCase {
 			$this->navigationManager,
 			$this->urlGenerator,
 			$this->logger,
-			'test',
+			'files',
 			$isLoggedIn,
 			$isAdminUser
 		);
@@ -91,7 +91,7 @@ class SecurityMiddlewareTest extends \PHPUnit_Framework_TestCase {
 	public function testSetNavigationEntry(){
 		$this->navigationManager->expects($this->once())
 			->method('setActiveEntry')
-			->with($this->equalTo('test'));
+			->with($this->equalTo('files'));
 
 		$this->reader->reflect(__CLASS__, __FUNCTION__);
 		$this->middleware->beforeController(__CLASS__, __FUNCTION__);