diff --git a/scm-webapp/src/main/java/sonia/scm/group/xml/XmlGroupManager.java b/scm-webapp/src/main/java/sonia/scm/group/xml/XmlGroupManager.java
index 8e6296f75b..805095c598 100644
--- a/scm-webapp/src/main/java/sonia/scm/group/xml/XmlGroupManager.java
+++ b/scm-webapp/src/main/java/sonia/scm/group/xml/XmlGroupManager.java
@@ -401,6 +401,8 @@ public class XmlGroupManager extends AbstractGroupManager
   public Collection<Group> getAll(Comparator<Group> comparator, int start,
                                   int limit)
   {
+    SecurityUtil.assertIsAdmin(securityContextProvider);
+
     return Util.createSubCollection(groupDB.values(), comparator,
                                     new CollectionAppender<Group>()
     {
diff --git a/scm-webapp/src/main/java/sonia/scm/user/xml/XmlUserManager.java b/scm-webapp/src/main/java/sonia/scm/user/xml/XmlUserManager.java
index 0615c8a8a5..ee71d3fa8f 100644
--- a/scm-webapp/src/main/java/sonia/scm/user/xml/XmlUserManager.java
+++ b/scm-webapp/src/main/java/sonia/scm/user/xml/XmlUserManager.java
@@ -443,6 +443,8 @@ public class XmlUserManager extends AbstractUserManager
   public Collection<User> getAll(Comparator<User> comaparator, int start,
                                  int limit)
   {
+    SecurityUtil.assertIsAdmin(scurityContextProvider);
+
     return Util.createSubCollection(userDB.values(), comaparator,
                                     new CollectionAppender<User>()
     {