2 files changed, 22 insertions, 0 deletions

diff --git a/server/controllers/api/users.ts b/server/controllers/api/users.ts
index 5e96d789e..abe6b3ff7 100644
--- a/server/controllers/api/users.ts
+++ b/server/controllers/api/users.ts
@@ -88,6 +88,8 @@ usersRouter.get('/',
 )
 
 usersRouter.get('/:id',
+  authenticate,
+  ensureUserHasRight(UserRight.MANAGE_USERS),
   asyncMiddleware(usersGetValidator),
   getUser
 )
diff --git a/server/tests/api/check-params/users.ts b/server/tests/api/check-params/users.ts
index ee591d620..a3e415b94 100644
--- a/server/tests/api/check-params/users.ts
+++ b/server/tests/api/check-params/users.ts
@@ -308,6 +308,26 @@ describe('Test users API validators', function () {
     })
   })
 
+  describe('When getting a user', function () {
+    before(async function () {
+      const res = await getUsersList(server.url, server.accessToken)
+
+      userId = res.body.data[1].id
+    })
+
+    it('Should fail with an non authenticated user', async function () {
+      await makeGetRequest({ url: server.url, path: path + userId, token: 'super token', statusCodeExpected: 401 })
+    })
+
+    it('Should fail with a non admin user', async function () {
+      await makeGetRequest({ url: server.url, path, token: userAccessToken, statusCodeExpected: 403 })
+    })
+
+    it('Should succeed with the correct params', async function () {
+      await makeGetRequest({ url: server.url, path: path + userId, token: server.accessToken, statusCodeExpected: 200 })
+    })
+  })
+
   describe('When updating a user', function () {
 
     before(async function () {