diff --git a/docsfera.json b/docsfera.json
index d79ce2d..68b2806 100644
--- a/docsfera.json
+++ b/docsfera.json
@@ -1321,9 +1321,6 @@
             "Users"
           ],
           "security": [
-            {
-              "access-token": []
-            },
             {
               "access-token": []
             }
diff --git a/src/modules/users/users.controller.ts b/src/modules/users/users.controller.ts
index e565f18..b5cb32b 100644
--- a/src/modules/users/users.controller.ts
+++ b/src/modules/users/users.controller.ts
@@ -266,7 +266,6 @@ export class UsersController {
   }
 
   @Patch(':id')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
   @ApiOkResponse({ type: UpdateUserRes })
   async updateUser(
     @User() user: RequestUser,
@@ -274,6 +273,10 @@ export class UsersController {
     @Param('id') id: string,
     @Language() language: LanguageEnum,
   ) {
+
+    if (user.user_id !== id || !user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)) {
+      throw new ErrorBuilder(ErrorCodes.AUTH.FORBIDDEN);
+    }
     this.logger.info('updateUser', { user });
     this.userService.setLanguage(language);
     return await this.userService.updateUser(body, id, user.customer_id);
diff --git a/src/modules/users/users.service.ts b/src/modules/users/users.service.ts
index 065a768..278188c 100644
--- a/src/modules/users/users.service.ts
+++ b/src/modules/users/users.service.ts
@@ -149,7 +149,7 @@ export class UsersService implements OnModuleInit {
 
   async updateUser(req: UpdateUserReq, id: string, customerId: string) {
     const { roleNames, ...updateUserDTO } = req;
-    if (roleNames) {
+    if (roleNames && roleNames.length > 0) {
       await this.setRoles({ roleNames, userId: id }, customerId);
     }