diff --git a/packages/server/src/routes/chat-messages/index.ts b/packages/server/src/routes/chat-messages/index.ts
index efea8da9cca..dd98edb820d 100644
--- a/packages/server/src/routes/chat-messages/index.ts
+++ b/packages/server/src/routes/chat-messages/index.ts
@@ -1,5 +1,6 @@
 import express from 'express'
 import chatMessageController from '../../controllers/chat-messages'
+import { checkAnyPermission } from '../../enterprise/rbac/PermissionCheck'
 const router = express.Router()
 
 // CREATE
@@ -7,12 +8,24 @@ const router = express.Router()
 // router.post(['/', '/:id'], chatMessageController.createChatMessage)
 
 // READ
-router.get(['/', '/:id'], chatMessageController.getAllChatMessages)
+router.get(
+    ['/', '/:id'],
+    checkAnyPermission('chatflows:view,chatflows:update,agentflows:view,agentflows:update'),
+    chatMessageController.getAllChatMessages
+)
 
 // UPDATE
-router.put(['/abort/', '/abort/:chatflowid/:chatid'], chatMessageController.abortChatMessage)
+router.put(
+    ['/abort/', '/abort/:chatflowid/:chatid'],
+    checkAnyPermission('chatflows:create,chatflows:update,agentflows:create,agentflows:update'),
+    chatMessageController.abortChatMessage
+)
 
 // DELETE
-router.delete(['/', '/:id'], chatMessageController.removeAllChatMessages)
+router.delete(
+    ['/', '/:id'],
+    checkAnyPermission('chatflows:delete,agentflows:delete,assistants:delete'),
+    chatMessageController.removeAllChatMessages
+)
 
 export default router
diff --git a/packages/server/src/routes/internal-chat-messages/index.ts b/packages/server/src/routes/internal-chat-messages/index.ts
index 5dcf1e67505..98e60a8f39b 100644
--- a/packages/server/src/routes/internal-chat-messages/index.ts
+++ b/packages/server/src/routes/internal-chat-messages/index.ts
@@ -1,11 +1,16 @@
 import express from 'express'
 import chatMessagesController from '../../controllers/chat-messages'
+import { checkAnyPermission } from '../../enterprise/rbac/PermissionCheck'
 const router = express.Router()
 
 // CREATE
 
 // READ
-router.get(['/', '/:id'], chatMessagesController.getAllInternalChatMessages)
+router.get(
+    ['/', '/:id'],
+    checkAnyPermission('chatflows:view,chatflows:update,agentflows:view,agentflows:update'),
+    chatMessagesController.getAllInternalChatMessages
+)
 
 // UPDATE