diff --git a/module/execution/model.php b/module/execution/model.php
index f80cdac3d4..dcc6f5b45c 100644
--- a/module/execution/model.php
+++ b/module/execution/model.php
@@ -63,6 +63,8 @@ class executionModel extends model
      */
     public function setMenu($executionID, $buildID = 0, $extra = '')
     {
+        if(strpos(",{$this->app->user->view->sprints},", ",$executionID,") === false) die(js::error($this->lang->execution->accessDenied) . js::locate('back'));
+
         $executions = $this->loadModel('execution')->getPairs(0, 'all', 'nocode');
         if(!$executionID and $this->session->execution) $executionID = $this->session->execution;
         if(!$executionID or !in_array($executionID, array_keys($executions))) $executionID = key($executions);
diff --git a/module/product/model.php b/module/product/model.php
index 438160fcf3..4aff9bb1f7 100644
--- a/module/product/model.php
+++ b/module/product/model.php
@@ -1980,6 +1980,8 @@ class productModel extends model
      */
     public function setMenu($productID, $branch = 0, $module = 0, $moduleType = '', $extra = '')
     {
+        if(strpos(",{$this->app->user->view->products},", ",$productID,") === false) die(js::error($this->lang->product->accessDenied) . js::locate('back'));
+
         $product = $this->getByID($productID);
         $params  = array('branch' => $branch);
         common::setMenuVars('product', $productID, $params);