diff --git a/frigate/api/media.py b/frigate/api/media.py
index fd48a11e14..43a82b26f3 100644
--- a/frigate/api/media.py
+++ b/frigate/api/media.py
@@ -896,6 +896,9 @@ async def event_thumbnail(
                 if event_id in camera_state.tracked_objects:
                     tracked_obj = camera_state.tracked_objects.get(event_id)
                     if tracked_obj is not None:
+                        await require_camera_access(
+                            camera_state.name, request=request
+                        )
                         thumbnail_bytes = tracked_obj.get_thumbnail(extension.value)
         except Exception:
             return JSONResponse(