diff --git a/src/api/vm.coffee b/src/api/vm.coffee
index d7be1f38a..98d14627a 100644
--- a/src/api/vm.coffee
+++ b/src/api/vm.coffee
@@ -478,6 +478,8 @@ set = $coroutine (params) ->
       yield xapi.call 'VM.remove_from_other_config', ref, 'auto_poweron'
 
   if 'cpuWeight' of params
+    if resourceSet? and this.user.permission isnt 'admin'
+      throw new Unauthorized()
     yield xapi.setVcpuWeight(VM._xapiId, params.cpuWeight)
 
   # Other fields.