diff --git a/application/Espo/Tools/Email/Api/PostUsers.php b/application/Espo/Tools/Email/Api/PostUsers.php index fdf62c1de4..8c2eecf553 100644 --- a/application/Espo/Tools/Email/Api/PostUsers.php +++ b/application/Espo/Tools/Email/Api/PostUsers.php @@ -140,6 +140,10 @@ class PostUsers implements Action if (!$this->acl->checkEntityRead($user)) { throw new Forbidden("No access to user."); } + + if (!$user->isRegular() && !$user->isAdmin()) { + throw new Forbidden("Only regular and admin users allowed."); + } } return $users;