diff --git a/scm-webapp/src/main/java/sonia/scm/web/security/BasicSecurityContext.java b/scm-webapp/src/main/java/sonia/scm/web/security/BasicSecurityContext.java
index b14674de93..943cccc982 100644
--- a/scm-webapp/src/main/java/sonia/scm/web/security/BasicSecurityContext.java
+++ b/scm-webapp/src/main/java/sonia/scm/web/security/BasicSecurityContext.java
@@ -298,11 +298,22 @@ public class BasicSecurityContext implements WebSecurityContext
    */
   private boolean isAdmin()
   {
-    boolean result = configuration.getAdminUsers().contains(user.getName());
+    boolean result = false;
+    Set<String> adminUsers = configuration.getAdminUsers();
+
+    if (adminUsers != null)
+    {
+      result = adminUsers.contains(user.getName());
+    }
 
     if (!result)
     {
-      result = Util.containsOne(configuration.getAdminGroups(), groups);
+      Set<String> adminGroups = configuration.getAdminGroups();
+
+      if (adminGroups != null)
+      {
+        result = Util.containsOne(adminGroups, groups);
+      }
     }
 
     return result;