diff --git a/server/controllers/UserController.js b/server/controllers/UserController.js
index 196f7d4d..2c2caf21 100644
--- a/server/controllers/UserController.js
+++ b/server/controllers/UserController.js
@@ -179,7 +179,7 @@ class UserController {
   // POST: api/users/online (admin)
   async getOnlineUsers(req, res) {
     if (!req.user.isAdminOrUp) {
-      return res.sendStatus(404)
+      return res.sendStatus(403)
     }
     const usersOnline = this.getUsersOnline()