diff --git a/cli/CliController.php b/cli/CliController.php
index 2e558158f..c232ec741 100755
--- a/cli/CliController.php
+++ b/cli/CliController.php
@@ -6,8 +6,10 @@
  */
 abstract class CliController extends Controller {
     function init() {
-      $this->disableBasicAuth();
-      parent::init();
+		$this->disableBasicAuth();
+		parent::init();
+		// Unless called from the command line, all CliControllers need ADMIN privileges
+		if(!Director::is_cli() && !Permission::check("ADMIN")) return Security::permissionFailure();
     }
   
     function index() {