diff --git a/tag/user.php b/tag/user.php
index 983fdb95a20..8b8d7abd932 100644
--- a/tag/user.php
+++ b/tag/user.php
@@ -45,7 +45,7 @@ switch ($action) {
         break;
 
     case 'flaginappropriate':
-
+        require_capability('moodle/tag:flag', context_system::instance());
         $tagid = tag_get_id($tag);
 
         tag_set_flag($tagid);