diff --git a/addons/event/security/ir.model.access.csv b/addons/event/security/ir.model.access.csv
index ac13c583b55..2c5d6a3b17a 100644
--- a/addons/event/security/ir.model.access.csv
+++ b/addons/event/security/ir.model.access.csv
@@ -5,7 +5,7 @@ access_event_event_portal,event.event.portal,model_event_event,,1,0,0,0
 access_event_event_user,event.event.user,model_event_event,event.group_event_user,1,0,0,0
 access_event_event_manager,event.event.manager,model_event_event,event.group_event_manager,1,1,1,1
 access_event_registration,event.registration,model_event_registration,event.group_event_user,1,1,1,1
-access_event_registration_portal,event.registration,model_event_registration,,1,0,0,0
+access_event_registration_portal,event.registration,model_event_registration,,0,0,0,0
 access_event_mail,event.mail,model_event_mail,event.group_event_user,1,0,0,0
 access_event_mail_manager,event.mail manager,model_event_mail,event.group_event_manager,1,1,1,1
 access_event_mail_registration,event.mail.registration,model_event_mail_registration,event.group_event_user,1,0,0,0
diff --git a/addons/website_event_sale/controllers/main.py b/addons/website_event_sale/controllers/main.py
index 33f1775ba42..f3a8ca30ad6 100644
--- a/addons/website_event_sale/controllers/main.py
+++ b/addons/website_event_sale/controllers/main.py
@@ -39,7 +39,7 @@ class WebsiteEventSaleController(WebsiteEventController):
         # free tickets -> order with amount = 0: auto-confirm, no checkout
         if not order.amount_total:
             order.action_confirm()  # tde notsure: email sending ?
-            attendees = request.env['event.registration'].browse(list(attendee_ids))
+            attendees = request.env['event.registration'].browse(list(attendee_ids)).sudo()
             # clean context and session, then redirect to the confirmation page
             request.website.sale_reset()
             return request.render("website_event.registration_complete", {