diff --git a/src/js/client.js b/src/js/client.js
index a3b939cd5..80dd0d636 100644
--- a/src/js/client.js
+++ b/src/js/client.js
@@ -556,6 +556,8 @@ angular.module('Application').service('Client', ['$http', '$interval', 'md5', 'N
     };
 
     Client.prototype.getUpdateInfo = function (callback) {
+        if (!this._userInfo.admin) return callback(new Error('Not allowed'));
+
         get('/api/v1/cloudron/update', null, function (error, data, status) {
             if (error) return callback(error);
             if (status !== 200) return callback(new ClientError(status, data));
@@ -2005,6 +2007,8 @@ angular.module('Application').service('Client', ['$http', '$interval', 'md5', 'N
     };
 
     Client.prototype.getSubscription = function (callback) {
+        if (!this._userInfo.admin) return callback(new Error('Not allowed'));
+
         get('/api/v1/appstore/subscription', null, function (error, data, status) {
             if (error) return callback(error);
             if (status !== 200) return callback(new ClientError(status, data));
diff --git a/src/js/main.js b/src/js/main.js
index f661b7cfd..08d6cf314 100644
--- a/src/js/main.js
+++ b/src/js/main.js
@@ -83,6 +83,8 @@ angular.module('Application').controller('MainController', ['$scope', '$route',
 
     // NOTE: this function is exported and called from the settings.js
     $scope.updateSubscriptionStatus = function () {
+        if (!Client.getUserInfo().admin) return;
+
         Client.getSubscription(function (error, subscription) {
             if (error && error.statusCode === 412) return; // ignore if not yet registered
             if (error) console.error(error);