diff --git a/modules/marketing_email/CHANGELOG b/modules/marketing_email/CHANGELOG
index 1778f88681..a7fd07375a 100644
--- a/modules/marketing_email/CHANGELOG
+++ b/modules/marketing_email/CHANGELOG
@@ -1,3 +1,4 @@
+* Enforce access rights on the email template record (issue14907)
 
 Version 8.0.0 - 2026-04-20
 --------------------------
diff --git a/modules/marketing_email/marketing.py b/modules/marketing_email/marketing.py
index 8a2ed93b23..8b8195525a 100644
--- a/modules/marketing_email/marketing.py
+++ b/modules/marketing_email/marketing.py
@@ -29,6 +29,11 @@ from trytond.transaction import Transaction, inactive_records
 from trytond.url import http_base
 from trytond.wizard import Button, StateTransition, StateView, Wizard
 
+try:
+    from trytond.model import ModelAccessProxy
+except ImportError:
+    ModelAccessProxy = None
+
 from .exceptions import EMailValidationError, TemplateError
 
 
@@ -427,6 +432,7 @@ class Message(Workflow, ModelSQL, ModelView):
     def process(cls, messages=None, emails=None, smtpd_datamanager=None):
         pool = Pool()
         WebShortener = pool.get('web.shortened_url')
+        ModelData = pool.get('ir.model.data')
         spy_pixel = config.getboolean(
             'marketing', 'email_spy_pixel', default=False)
 
@@ -480,6 +486,12 @@ class Message(Workflow, ModelSQL, ModelView):
                         message=message.rec_name,
                         exception=exception)) from exception
             for email in (emails or message.list_.emails):
+                if ModelAccessProxy:
+                    email = ModelAccessProxy(
+                        email, {
+                            '_groups': [
+                                ModelData.get_id('marketing.group_marketing')],
+                            })
                 content = (template
                     .generate(
                         email=email,