diff --git a/routers/router.go b/routers/router.go
index 70f345ea..7c5a84cd 100644
--- a/routers/router.go
+++ b/routers/router.go
@@ -927,6 +927,7 @@ func initMasterRouter(dep dependency.Dep) *gin.Engine {
 						controllers.AdminFetchWopi,
 					)
 					tool.POST("thumbExecutable",
+						middleware.RequiredScopes(types.ScopeAdminWrite),
 						controllers.FromJSON[adminsvc.ThumbGeneratorTestService](adminsvc.ThumbGeneratorTestParamCtx{}),
 						controllers.AdminTestThumbGenerator)
 					tool.POST("mail",