diff --git a/packages/backend/src/graphql/queries/get-flow.ts b/packages/backend/src/graphql/queries/get-flow.ts
index b7d39852..6d767118 100644
--- a/packages/backend/src/graphql/queries/get-flow.ts
+++ b/packages/backend/src/graphql/queries/get-flow.ts
@@ -5,6 +5,8 @@ type Params = {
 };
 
 const getFlow = async (_parent: unknown, params: Params, context: Context) => {
+  context.currentUser.can('read', 'Flow');
+
   const flow = await context.currentUser
     .$relatedQuery('flows')
     .withGraphJoined('[steps.[connection]]')