diff --git a/application/Espo/Core/ORM/Type/FieldType.php b/application/Espo/Core/ORM/Type/FieldType.php
index 1e28e439a8..01d5216022 100644
--- a/application/Espo/Core/ORM/Type/FieldType.php
+++ b/application/Espo/Core/ORM/Type/FieldType.php
@@ -63,4 +63,5 @@ class FieldType
     public const WYSIWYG = 'wysiwyg';
     public const JSON_ARRAY = 'jsonArray';
     public const JSON_OBJECT = 'jsonObject';
+    public const PASSWORD = 'password';
 }
diff --git a/application/Espo/Core/Select/Order/Applier.php b/application/Espo/Core/Select/Order/Applier.php
index da93aa0b19..70d258fc82 100644
--- a/application/Espo/Core/Select/Order/Applier.php
+++ b/application/Espo/Core/Select/Order/Applier.php
@@ -76,6 +76,10 @@ class Applier
             if ($this->metadataProvider->isFieldOrderDisabled($this->entityType, $orderBy)) {
                 throw new Forbidden("Order by the field '$orderBy' is disabled.");
             }
+
+            if ($this->metadataProvider->getFieldType($this->entityType, $orderBy) === FieldType::PASSWORD) {
+                throw new Forbidden("Order by field '$orderBy' is not allowed.");
+            }
         }
 
         if ($orderBy === null) {
diff --git a/application/Espo/Resources/metadata/entityDefs/User.json b/application/Espo/Resources/metadata/entityDefs/User.json
index 77ebb9a912..2fc1669517 100644
--- a/application/Espo/Resources/metadata/entityDefs/User.json
+++ b/application/Espo/Resources/metadata/entityDefs/User.json
@@ -52,7 +52,8 @@
             "directAccessDisabled": true,
             "fieldManagerParamList": [
                 "tooltipText"
-            ]
+            ],
+            "orderDisabled": true
         },
         "passwordConfirm": {
             "type": "password",
@@ -88,7 +89,8 @@
                 "tooltipText"
             ],
             "copyToClipboard": true,
-            "dynamicLogicVisibleDisabled": true
+            "dynamicLogicVisibleDisabled": true,
+            "orderDisabled": true
         },
         "secretKey": {
             "type": "varchar",