diff --git a/src/routes/users.js b/src/routes/users.js
index 455b3a3bd..e52415164 100644
--- a/src/routes/users.js
+++ b/src/routes/users.js
@@ -195,6 +195,7 @@ async function setLocalGroups(req, res, next) {
     assert.strictEqual(typeof req.resource, 'object');
 
     if (!Array.isArray(req.body.groupIds)) return next(new HttpError(400, 'API call requires a groups array.'));
+    if (req.body.groupIds.some((gid) => typeof gid !== 'string')) return next(new HttpError(400, 'groupIds array must contain strings'));
     if (users.compareRoles(req.user.role, req.resource.role) < 0) return next(new HttpError(403, `role '${req.resource.role}' is required but user has only '${req.user.role}'`));
 
     const [error] = await safe(groups.setLocalMembership(req.resource, req.body.groupIds));