diff --git a/lib/Controller/FolderController.php b/lib/Controller/FolderController.php
index 0293a2019..b24079137 100644
--- a/lib/Controller/FolderController.php
+++ b/lib/Controller/FolderController.php
@@ -95,6 +95,7 @@ private function formatFolder(array $folder): array {
 	 *
 	 * 200: Groupfolders returned
 	 */
+	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[FrontpageRoute(verb: 'GET', url: '/folders')]
 	public function getFolders(bool $applicable = false): DataResponse {
@@ -133,6 +134,7 @@ public function getFolders(bool $applicable = false): DataResponse {
 	 *
 	 * 200: Groupfolder returned
 	 */
+	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[FrontpageRoute(verb: 'GET', url: '/folders/{id}')]
 	public function getFolder(int $id): DataResponse {
@@ -479,6 +481,7 @@ private function folderDataForXML(array $data): array {
 	 *
 	 * 200: ACL Mappings returned
 	 */
+	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[FrontpageRoute(verb: 'GET', url: '/folders/{id}/search')]
 	public function aclMappingSearch(int $id, string $search = ''): DataResponse {