diff --git a/CHANGELOG.md b/CHANGELOG.md
index c4871b8c9..b80ee6e75 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 * Fix HTML escaping of module, script and session fields on the Webmin Actions Log details page
 * Fix mailbox attachment option injection
 * Fix path traversal and command injection in parameterized Custom Commands file editors
+* Fix MySQL/MariaDB manual editor ACL bypass
 
 #### 2.670 (September 20, 2026)
 * Add new Hardware Information module for inspecting system, firmware, security, PCI, USB, storage, network, processor, sensor, driver, and kernel module details
diff --git a/mysql/edit_manual.cgi b/mysql/edit_manual.cgi
index 864c456bb..c6b7dfbfa 100755
--- a/mysql/edit_manual.cgi
+++ b/mysql/edit_manual.cgi
@@ -2,6 +2,7 @@
 # Show a config file for manual editing
 
 require './mysql-lib.pl';
+$access{'perms'} == 1 || &error($text{'cnf_ecannot'});
 &ReadParse();
 &ui_print_header($header_subtext, $text{'manual_title'}, "");
 
diff --git a/mysql/save_manual.cgi b/mysql/save_manual.cgi
index d23d0b1a2..81fac60b7 100755
--- a/mysql/save_manual.cgi
+++ b/mysql/save_manual.cgi
@@ -2,6 +2,7 @@
 # Save a manually edited config file
 
 require './mysql-lib.pl';
+$access{'perms'} == 1 || &error($text{'cnf_ecannot'});
 &ReadParseMime();
 &error_setup($text{'manual_err'});