diff --git a/packages/ui-default/handler.ts b/packages/ui-default/handler.ts
index 2dceea0ca..89a3dfcaa 100644
--- a/packages/ui-default/handler.ts
+++ b/packages/ui-default/handler.ts
@@ -6,7 +6,7 @@ import { join } from 'path';
 import { ObjectID } from 'mongodb';
 import * as bus from 'hydrooj/src/service/bus';
 import { Route, Handler } from 'hydrooj/src/service/server';
-import { PERM } from 'hydrooj/src/model/builtin';
+import { PERM, PRIV } from 'hydrooj/src/model/builtin';
 import markdown from './backendlib/markdown';
 
 const {
@@ -88,6 +88,7 @@ class SetThemeHandler extends Handler {
   noCheckPermView = true;
 
   async get({ theme }) {
+    this.checkPriv(PRIV.PRIV_USER_PROFILE);
     await user.setById(this.user._id, { theme });
     this.back();
   }
diff --git a/packages/ui-default/package.json b/packages/ui-default/package.json
index 3f619262d..4f9712aea 100644
--- a/packages/ui-default/package.json
+++ b/packages/ui-default/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hydrooj/ui-default",
-  "version": "4.34.11",
+  "version": "4.34.12",
   "author": "undefined <i@undefined.moe>",
   "license": "AGPL-3.0",
   "main": "hydro.js",