Problem solved. It turned out that a table trigger was setting an extended property, which is a system table, and the application role does not have rights to that.