diff --git a/CHANGES.rst b/CHANGES.rst
index a74c357e93..82c5b96664 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -24,6 +24,9 @@ Fixes
 
 - Prevent encoding issues in existing DTML Method and Document objects
 
+- Fixed logic error in exceptions handling during publishing. This error would
+  prevent correct Unauthorized handling when exceptions debug mode was set.
+
 
 4.0 (2019-05-10)
 ----------------
diff --git a/src/ZPublisher/WSGIPublisher.py b/src/ZPublisher/WSGIPublisher.py
index bb0bb581f4..9cef5404a1 100644
--- a/src/ZPublisher/WSGIPublisher.py
+++ b/src/ZPublisher/WSGIPublisher.py
@@ -176,10 +176,13 @@ def transaction_pubevents(request, response, tm=transaction.manager):
             if request.environ.get('x-wsgiorg.throw_errors', False):
                 reraise(*exc_info)
 
+            retry = False
+            unauth = False
+            debug_exc = getattr(response, 'debug_exceptions', False)
+
             # If the exception is transient and the request can be retried,
             # shortcut further processing. It makes no sense to have an
             # exception view registered for this type of exception.
-            retry = False
             if isinstance(exc, TransientError) and request.supports_retry():
                 retry = True
             else:
@@ -195,6 +198,7 @@ def transaction_pubevents(request, response, tm=transaction.manager):
                 # is used, an exception view for Unauthorized has to merge
                 # the state of the response and the exception instance.
                 if isinstance(exc, Unauthorized):
+                    unauth = True
                     exc.setRealm(response.realm)
                     response._unauthorized()
                     response.setStatus(exc.getStatus())
@@ -205,8 +209,7 @@ def transaction_pubevents(request, response, tm=transaction.manager):
             notify(pubevents.PubFailure(request, exc_info, retry))
 
             if retry or \
-               not (exc_view_created or isinstance(exc, Unauthorized)) or \
-               getattr(response, 'debug_exceptions', False):
+               (not unauth and (debug_exc or not exc_view_created)):
                 reraise(*exc_info)
 
         finally: