diff --git a/addons/hr_gamification/wizard/gamification_badge_user_wizard.py b/addons/hr_gamification/wizard/gamification_badge_user_wizard.py
index a2feb024688..5bbb6848bd3 100644
--- a/addons/hr_gamification/wizard/gamification_badge_user_wizard.py
+++ b/addons/hr_gamification/wizard/gamification_badge_user_wizard.py
@@ -2,14 +2,27 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
 from odoo import api, fields, models, _
-from odoo.exceptions import UserError
+from odoo.exceptions import UserError, AccessError
 
 
 class GamificationBadgeUserWizard(models.TransientModel):
     _inherit = 'gamification.badge.user.wizard'
 
     employee_id = fields.Many2one('hr.employee', string='Employee', required=True)
-    user_id = fields.Many2one('res.users', string='User', related='employee_id.user_id', store=True)
+    user_id = fields.Many2one('res.users', string='User',
+        related='employee_id.user_id', store=True, readonly=True)
+
+    # TODO 12.0/master remove this hack by changing the model
+    @api.model
+    def create(self, values):
+        employee = self.env['hr.employee'].browse(values['employee_id'])
+        values['user_id'] = employee.user_id.id
+        try:
+            return super(GamificationBadgeUserWizard, self).create(values)
+        except AccessError:
+            # an employee can not write on another employee
+            # force sudo because of related
+            return super(GamificationBadgeUserWizard, self.sudo()).create(values)
 
     @api.multi
     def action_grant_badge(self):