diff --git a/core/src/main/java/hudson/model/User.java b/core/src/main/java/hudson/model/User.java
index <HASH>..<HASH> 100644
--- a/core/src/main/java/hudson/model/User.java
+++ b/core/src/main/java/hudson/model/User.java
@@ -210,6 +210,7 @@ public class User extends AbstractModelObject implements AccessControlled {
      * Accepts the new description.
      */
     public synchronized void doSubmitDescription( StaplerRequest req, StaplerResponse rsp ) throws IOException, ServletException {
+        checkPermission(Hudson.ADMINISTER);
         req.setCharacterEncoding("UTF-8");
 
         description = req.getParameter("description");
[FIXED HUDSON-<I>] Requiring ADMINISTER permission to update description, mainly just because that's what the doConfigSubmit method is doing. This change will be in <I>.

git-svn-id: <URL>