diff --git a/scm-webapp/src/main/java/sonia/scm/filter/SecurityFilter.java b/scm-webapp/src/main/java/sonia/scm/filter/SecurityFilter.java
index dd1a273fd7..553356d8f6 100644
--- a/scm-webapp/src/main/java/sonia/scm/filter/SecurityFilter.java
+++ b/scm-webapp/src/main/java/sonia/scm/filter/SecurityFilter.java
@@ -94,6 +94,10 @@ public class SecurityFilter extends HttpFilter
         chain.doFilter(new SecurityHttpServletRequestWrapper(request,
           subject.getPrincipals().oneByType(User.class)), response);
       }
+      else if (subject.isAuthenticated())
+      {
+        response.sendError(HttpServletResponse.SC_FORBIDDEN);
+      }
       else
       {
         response.sendError(HttpServletResponse.SC_UNAUTHORIZED);