diff --git a/src/routes/user.js b/src/routes/user.js
index efeb1f21a..7ffacb917 100644
--- a/src/routes/user.js
+++ b/src/routes/user.js
@@ -195,15 +195,19 @@ function verifyPassword(req, res, next) {
 
     if (typeof req.body.password !== 'string') return next(new HttpError(400, 'API call requires user password'));
 
-    // Only allow admins or users, operating on themselves
-    if (req.params.userId && !(req.user.id === req.params.userId || req.user.admin)) return next(new HttpError(403, 'Not allowed'));
-
-    user.verify(req.user.username, req.body.password, function (error) {
-        if (error && error.reason === UserError.WRONG_PASSWORD) return next(new HttpError(403, 'Password incorrect'));
-        if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(403, 'Password incorrect'));
+    groups.isMember(groups.ADMIN_GROUP_ID, req.user.id, function (error, isAdmin) {
         if (error) return next(new HttpError(500, error));
 
-        next();
+        // Only allow admins or users, operating on themselves
+        if (req.params.userId && !(req.user.id === req.params.userId || isAdmin)) return next(new HttpError(403, 'Not allowed'));
+
+        user.verify(req.user.username, req.body.password, function (error) {
+            if (error && error.reason === UserError.WRONG_PASSWORD) return next(new HttpError(403, 'Password incorrect'));
+            if (error && error.reason === UserError.NOT_FOUND) return next(new HttpError(403, 'Password incorrect'));
+            if (error) return next(new HttpError(500, error));
+
+            next();
+        });
     });
 }