diff --git a/classes/controller.php b/classes/controller.php
index 8f63efc5..53fbf9f7 100644
--- a/classes/controller.php
+++ b/classes/controller.php
@@ -691,7 +691,9 @@ class AdminController
     {
         require_once __DIR__ . '/gpm.php';
 
-        //TODO: manage permissions
+        if (!$this->authoriseTask('install grav', ['admin.super'])) {
+            return;
+        }
 
         $result = \Grav\Plugin\Admin\Gpm::selfupgrade();