diff --git a/Changes b/Changes
index b048dc5..27b711d 100644
--- a/Changes
+++ b/Changes
@@ -6,6 +6,7 @@
 - Fix datatype for query statistics (close #802)
 - Remove admin test data from database migration (close #808)
 - Remove user default settings from the database migration (close #810)
+- Fix KoralQuery and remove required access from query reference.
 
 # version 0.78.2
 
diff --git a/src/main/java/de/ids_mannheim/korap/dto/converter/QueryConverter.java b/src/main/java/de/ids_mannheim/korap/dto/converter/QueryConverter.java
index 3d469a9..12e5378 100644
--- a/src/main/java/de/ids_mannheim/korap/dto/converter/QueryConverter.java
+++ b/src/main/java/de/ids_mannheim/korap/dto/converter/QueryConverter.java
@@ -4,6 +4,7 @@
 
 import com.fasterxml.jackson.databind.JsonNode;
 
+import de.ids_mannheim.korap.constant.QueryType;
 import de.ids_mannheim.korap.dto.QueryDto;
 import de.ids_mannheim.korap.entity.QueryDO;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
@@ -27,7 +28,9 @@
         dto.setId(query.getId());
         dto.setName(query.getName());
         dto.setCreatedBy(query.getCreatedBy());
-        dto.setRequiredAccess(query.getRequiredAccess().name());
+        if (query.getQueryType().equals(QueryType.VIRTUAL_CORPUS)) {
+        	dto.setRequiredAccess(query.getRequiredAccess().name());
+        }
         dto.setStatus(query.getStatus());
         dto.setDescription(query.getDescription());
         dto.setType(query.getType().displayName());
diff --git a/src/main/java/de/ids_mannheim/korap/service/QueryService.java b/src/main/java/de/ids_mannheim/korap/service/QueryService.java
index cfa16fd..e3b0ce6 100644
--- a/src/main/java/de/ids_mannheim/korap/service/QueryService.java
+++ b/src/main/java/de/ids_mannheim/korap/service/QueryService.java
@@ -365,7 +365,7 @@
             }
         }
 
-        CorpusAccess requiredAccess = CorpusAccess.PUB;
+        CorpusAccess requiredAccess = CorpusAccess.FREE;
         if (queryType.equals(QueryType.VIRTUAL_CORPUS)) {
             requiredAccess = determineRequiredAccess(isCached, queryName,
                     koralQuery);
@@ -433,7 +433,8 @@
         if (DEBUG) {
             jlog.debug(koralQuery);
         }
-        return koralQuery;
+        JsonNode n = JsonUtils.readTree(koralQuery).get("query");
+        return n.toString();
     }
 
     public CorpusAccess determineRequiredAccess (boolean isCached, String name,
diff --git a/src/test/java/de/ids_mannheim/korap/config/TestBase.java b/src/test/java/de/ids_mannheim/korap/config/TestBase.java
index fab897b..449e447 100644
--- a/src/test/java/de/ids_mannheim/korap/config/TestBase.java
+++ b/src/test/java/de/ids_mannheim/korap/config/TestBase.java
@@ -4,6 +4,8 @@
 
 import java.util.Map;
 
+import org.apache.http.entity.ContentType;
+
 import com.fasterxml.jackson.databind.JsonNode;
 import com.google.common.net.HttpHeaders;
 
@@ -46,4 +48,28 @@
                 node.at("/errors/0/0").asInt());
         assertEquals(username, node.at("/errors/0/2").asText());
     }
+	
+	protected void createDoryQuery () throws KustvaktException {
+		String json = "{\"type\": \"PRIVATE\"" + ",\"queryType\": \"QUERY\""
+				+ ",\"queryLanguage\": \"poliqarp\""
+				+ ",\"query\": \"[]\"}";
+		String qName = "dory-q";
+		Response response = target().path(API_VERSION).path("query")
+				.path("~dory").path(qName).request()
+				.header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+						.createBasicAuthorizationHeaderValue("dory", "pass"))
+				.header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
+				.put(Entity.json(json));
+		assertEquals(Status.CREATED.getStatusCode(), response.getStatus());
+	}
+	
+	protected void deleteDoryQuery () throws KustvaktException {
+		Response response = target().path(API_VERSION).path("query")
+				.path("~dory").path("dory-q").request()
+				.header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
+						.createBasicAuthorizationHeaderValue("dory", "pass"))
+				.delete();
+		assertEquals(Status.OK.getStatusCode(), response.getStatus());
+
+	}
 }
diff --git a/src/test/java/de/ids_mannheim/korap/rewrite/QueryReferenceRewriteTest.java b/src/test/java/de/ids_mannheim/korap/rewrite/QueryReferenceRewriteTest.java
index d6da757..9e3f334 100644
--- a/src/test/java/de/ids_mannheim/korap/rewrite/QueryReferenceRewriteTest.java
+++ b/src/test/java/de/ids_mannheim/korap/rewrite/QueryReferenceRewriteTest.java
@@ -4,11 +4,12 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import org.junit.jupiter.api.Test;
+
 import com.fasterxml.jackson.databind.JsonNode;
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.SpringJerseyTest;
+import de.ids_mannheim.korap.config.TestBase;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.utils.JsonUtils;
 import jakarta.ws.rs.core.Response;
@@ -16,7 +17,7 @@
 /**
  * @author diewald
  */
-public class QueryReferenceRewriteTest extends SpringJerseyTest {
+public class QueryReferenceRewriteTest extends TestBase {
 
     @Test
     public void testRewriteRefNotFound () throws KustvaktException, Exception {
@@ -49,6 +50,8 @@
 
     @Test
     public void testRewriteRefRewrite () throws KustvaktException, Exception {
+    	createDoryQuery();
+    	
         // Added in the database migration sql for tests
         Response response = target().path(API_VERSION).path("search")
                 .queryParam("q", "{q}").queryParam("ql", "poliqarp")
@@ -68,5 +71,7 @@
         assertEquals("koral:queryRef", node.at("/0/original/@type").asText());
         assertEquals("dory/dory-q", node.at("/0/original/ref").asText());
         assertTrue(node.at("/0/scope").isMissingNode());
+        
+        deleteDoryQuery();
     }
 }
diff --git a/src/test/java/de/ids_mannheim/korap/web/controller/QueryReferenceControllerTest.java b/src/test/java/de/ids_mannheim/korap/web/controller/QueryReferenceControllerTest.java
index 57dc847..363b844 100644
--- a/src/test/java/de/ids_mannheim/korap/web/controller/QueryReferenceControllerTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/controller/QueryReferenceControllerTest.java
@@ -4,33 +4,33 @@
 
 import org.apache.http.entity.ContentType;
 import org.junit.jupiter.api.Test;
+
 import com.fasterxml.jackson.databind.JsonNode;
 import com.google.common.net.HttpHeaders;
-import jakarta.ws.rs.ProcessingException;
-import jakarta.ws.rs.core.Response;
-import jakarta.ws.rs.core.Response.Status;
-import jakarta.ws.rs.client.Entity;
 
 import de.ids_mannheim.korap.authentication.http.HttpAuthorizationHandler;
 import de.ids_mannheim.korap.config.Attributes;
-import de.ids_mannheim.korap.config.SpringJerseyTest;
+import de.ids_mannheim.korap.config.TestBase;
 import de.ids_mannheim.korap.constant.ResourceType;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
-import de.ids_mannheim.korap.user.User.CorpusAccess;
 import de.ids_mannheim.korap.utils.JsonUtils;
+import jakarta.ws.rs.ProcessingException;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.Status;
 
-public class QueryReferenceControllerTest extends SpringJerseyTest {
+public class QueryReferenceControllerTest extends TestBase {
 
     private String testUser = "qRefControllerTest";
 
     private String adminUser = "admin";
 
     private String system = "system";
-
-    private void testRetrieveQueryByName (String qName, String query,
-            String queryCreator, String username, ResourceType resourceType,
-            CorpusAccess access) throws KustvaktException {
+    
+	private void testRetrieveQueryByName (String qName, String query,
+			String queryCreator, String username,
+			ResourceType resourceType) throws KustvaktException {
         Response response = target().path(API_VERSION).path("query")
                 .path("~" + queryCreator).path(qName).request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
@@ -45,7 +45,6 @@
         assertEquals(queryCreator, node.at("/createdBy").asText());
         assertEquals(query, node.at("/query").asText());
         assertEquals(node.at("/queryLanguage").asText(), "poliqarp");
-        assertEquals(access.name(), node.at("/requiredAccess").asText());
     }
 
     private void testUpdateQuery (String qName, String qCreator,
@@ -60,8 +59,7 @@
                 .header(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_JSON)
                 .put(Entity.json(json));
         assertEquals(Status.NO_CONTENT.getStatusCode(), response.getStatus());
-        testRetrieveQueryByName(qName, "Sonne", qCreator, username, type,
-                CorpusAccess.PUB);
+        testRetrieveQueryByName(qName, "Sonne", qCreator, username, type);
     }
 
     @Test
@@ -77,7 +75,7 @@
                 .put(Entity.json(json));
         assertEquals(Status.CREATED.getStatusCode(), response.getStatus());
         testRetrieveQueryByName(qName, "der", testUser, testUser,
-                ResourceType.PRIVATE, CorpusAccess.PUB);
+                ResourceType.PRIVATE);
         testUpdateQuery(qName, testUser, testUser, ResourceType.PRIVATE);
         testDeleteQueryByName(qName, testUser, testUser);
     }
@@ -95,7 +93,7 @@
                 .put(Entity.json(json));
         assertEquals(Status.CREATED.getStatusCode(), response.getStatus());
         testRetrieveQueryByName(qName, "Regen", testUser, testUser,
-                ResourceType.PUBLISHED, CorpusAccess.PUB);
+                ResourceType.PUBLISHED);
         testDeleteQueryByName(qName, testUser, testUser);
         // check if hidden group has been created
     }
@@ -114,7 +112,7 @@
                 .put(Entity.json(json));
         assertEquals(Status.CREATED.getStatusCode(), response.getStatus());
         testRetrieveQueryByName(qName, "Sommer", "marlin", adminUser,
-                ResourceType.PRIVATE, CorpusAccess.PUB);
+                ResourceType.PRIVATE);
         testUpdateQuery(qName, "marlin", adminUser, ResourceType.PRIVATE);
         testDeleteQueryByName(qName, "marlin", adminUser);
     }
@@ -133,7 +131,7 @@
                 .put(Entity.json(json));
         assertEquals(Status.CREATED.getStatusCode(), response.getStatus());
         testRetrieveQueryByName(qName, "Sommer", system, adminUser,
-                ResourceType.SYSTEM, CorpusAccess.PUB);
+                ResourceType.SYSTEM);
         testUpdateQuery(qName, system, adminUser, ResourceType.SYSTEM);
         testDeleteSystemQueryUnauthorized(qName);
         testDeleteQueryByName(qName, system, adminUser);
@@ -172,7 +170,7 @@
                 .put(Entity.json(json));
         assertEquals(Status.CREATED.getStatusCode(), response.getStatus());
         testRetrieveQueryByName(qName, "Sohn", testUser, testUser,
-                ResourceType.PRIVATE, CorpusAccess.PUB);
+                ResourceType.PRIVATE);
         testDeleteQueryByName(qName, testUser, testUser);
     }
 
@@ -249,6 +247,8 @@
 
     @Test
     public void testDeleteQueryUnauthorized () throws KustvaktException {
+    	createDoryQuery();
+    	
         Response response = target().path(API_VERSION).path("query")
                 .path("~dory").path("dory-q").request()
                 .header(Attributes.AUTHORIZATION, HttpAuthorizationHandler
@@ -261,6 +261,9 @@
                 node.at("/errors/0/0").asInt());
         assertEquals("Unauthorized operation for user: " + testUser,
                 node.at("/errors/0/1").asText());
+        
+        testListAvailableQueryForDory();
+        deleteDoryQuery();
     }
 
     private void testDeleteSystemQueryUnauthorized (String qName)
@@ -297,7 +300,6 @@
                 "dory/non-existing-query");
     }
 
-    @Test
     public void testListAvailableQueryForDory ()
             throws ProcessingException, KustvaktException {
         JsonNode node = testListAvailableQuery("dory");
@@ -314,8 +316,6 @@
                 node.at("/0/type").asText());
         assertEquals(node.at("/0/description").asText(), "\"system\" query");
         assertEquals(node.at("/0/query").asText(), "[]");
-        assertEquals(CorpusAccess.FREE.name(),
-                node.at("/0/requiredAccess").asText());
         // assertEquals("koral:token", node.at("/0/koralQuery/@type").asText());
     }
 
diff --git a/src/test/java/de/ids_mannheim/korap/web/controller/vc/VirtualCorpusControllerTest.java b/src/test/java/de/ids_mannheim/korap/web/controller/vc/VirtualCorpusControllerTest.java
index 9f53164..2dbf46f 100644
--- a/src/test/java/de/ids_mannheim/korap/web/controller/vc/VirtualCorpusControllerTest.java
+++ b/src/test/java/de/ids_mannheim/korap/web/controller/vc/VirtualCorpusControllerTest.java
@@ -331,6 +331,7 @@
         assertEquals(2, node.size());
         
         node = node.get(1);
+        System.out.println(node.toPrettyString());
         assertEquals(vcName, node.get("name").asText());
         assertEquals("ALL", node.get("requiredAccess").asText());
         deleteVC(vcName, testUser, testUser);