diff --git a/module/instance/control.php b/module/instance/control.php
index 73b8ff0f7b..7a8914972f 100644
--- a/module/instance/control.php
+++ b/module/instance/control.php
@@ -770,6 +770,7 @@ class instance extends control
      */
     public function ajaxDBAuthUrl()
     {
+        if(!commonModel::hasPriv('instance', 'view')) $this->loadModel('common')->deny('instance', 'view', false);
         $post = fixer::input('post')
             ->setDefault('namespace', 'default')
             ->setDefault('instanceID', 0)