only one token must match, see http://www.webdav.org/specs/rfc2518.html#rfc.section.9.4.2 [ci skip]

main/frontend-webdav/src/main/java/org/cryptomator/webdav/jackrabbitservlet/WebDavServlet.java

@@ -120,10 +120,10 @@ public class WebDavServlet extends AbstractWebdavServlet {
 	}
 
 	private boolean hasCorrectLockTokens(DavSession session, DavResource resource) {
-		boolean access = true;
+		boolean access = false;
 		final String[] providedLockTokens = session.getLockTokens();
 		for (ActiveLock lock : resource.getLocks()) {
-			access &= ArrayUtils.contains(providedLockTokens, lock.getToken());
+			access |= ArrayUtils.contains(providedLockTokens, lock.getToken());
 		}
 		return access;
 	}