diff --git a/pkg/cloudcommon/db/rbac.go b/pkg/cloudcommon/db/rbac.go
index 439af73377..c064b50beb 100644
--- a/pkg/cloudcommon/db/rbac.go
+++ b/pkg/cloudcommon/db/rbac.go
@@ -92,7 +92,7 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
 
 	if len(ownerId) > 0 {
 		objOwnerId := model.GetOwnerProjectId()
-		if ownerId == objOwnerId || model.IsSharable() {
+		if ownerId == objOwnerId || (model.IsSharable() && action == policy.PolicyActionGet) {
 			isOwner = true
 			requireAdmin = false
 		} else {