diff --git a/addons/hr_recruitment/models/hr_recruitment_source.py b/addons/hr_recruitment/models/hr_recruitment_source.py
index 7e10819ba4e..20c63faedbc 100644
--- a/addons/hr_recruitment/models/hr_recruitment_source.py
+++ b/addons/hr_recruitment/models/hr_recruitment_source.py
@@ -40,7 +40,11 @@ class RecruitmentSource(models.Model):
                 'alias_parent_thread_id': source.job_id.id,
                 'alias_parent_model_id': self.env['ir.model']._get_id('hr.job'),
             }
-            source.alias_id = self.env['mail.alias'].create(vals)
+
+            # check that you can create source before to call mail.alias in sudo with known/controlled vals
+            source.check_access_rights('create')
+            source.check_access_rule('create')
+            source.alias_id = self.env['mail.alias'].sudo().create(vals)
 
     def unlink(self):
         """ Cascade delete aliases to avoid useless / badly configured aliases. """
diff --git a/addons/mail/models/mail_alias.py b/addons/mail/models/mail_alias.py
index f436d5c1453..373ec77bd51 100644
--- a/addons/mail/models/mail_alias.py
+++ b/addons/mail/models/mail_alias.py
@@ -108,7 +108,9 @@ class Alias(models.Model):
         """ Check for invalid alias domains based on company configuration.
         When having a parent record and/or updating an existing record alias
         domain should match the one used on the related record. """
-        tocheck = self.filtered(lambda domain: domain.alias_domain_id.company_ids)
+
+        # in sudo, to be able to read alias_parent_model_id (ir.model)
+        tocheck = self.sudo().filtered(lambda domain: domain.alias_domain_id.company_ids)
         if not tocheck:
             return