1 files changed, 8 insertions, 0 deletions
diff --git a/app/services/projects/group_links/update_service.rb b/app/services/projects/group_links/update_service.rb
index 9b2565adaca..04f1552d929 100644
--- a/app/services/projects/group_links/update_service.rb
+++ b/app/services/projects/group_links/update_service.rb
@@ -10,15 +10,23 @@ module Projects
       end
 
       def execute(group_link_params)
+        return ServiceResponse.error(message: 'Not found', reason: :not_found) unless allowed_to_update?
+
         group_link.update!(group_link_params)
 
         refresh_authorizations if requires_authorization_refresh?(group_link_params)
+
+        ServiceResponse.success
       end
 
       private
 
       attr_reader :group_link
 
+      def allowed_to_update?
+        current_user.can?(:admin_project_member, project)
+      end
+
       def refresh_authorizations
         AuthorizedProjectUpdate::ProjectRecalculateWorker.perform_async(project.id)