diff --git a/include/ajax/ajax_card_attribute.php b/include/ajax/ajax_card_attribute.php
index 09ad2c1b5..d48feb9a3 100644
--- a/include/ajax/ajax_card_attribute.php
+++ b/include/ajax/ajax_card_attribute.php
@@ -23,9 +23,16 @@
  * @file
  * @brief answer to card_attr_inc.php
  */
+/*
+ * @var $g_user Noalyss_User
+ */
 global $g_user;
 // security
-$g_user->can_request("CCARDAT");
+if ( $g_user->check_module("C0CARD") == 0 ) {
+    
+    record_log(new \Exception("C0CARD1: not authorized"));
+    return;
+}
 
 $http=new HttpInput();