diff --git a/addons/mail/security/ir.model.access.csv b/addons/mail/security/ir.model.access.csv
index 89559c8adb1..4f3f6661396 100644
--- a/addons/mail/security/ir.model.access.csv
+++ b/addons/mail/security/ir.model.access.csv
@@ -30,7 +30,8 @@ access_mail_gateway_allowed_system,mail.gateway.allowed.system,model_mail_gatewa
 access_mail_message_reaction_all,mail.message.reaction.all,model_mail_message_reaction,,0,0,0,0
 access_mail_message_reaction_system,mail.message.reaction.system,model_mail_message_reaction,base.group_system,1,1,1,1
 access_mail_message_subtype_all,mail.message.subtype.all,model_mail_message_subtype,,1,0,0,0
-access_mail_message_subtype_user,mail.message.subtype.user,model_mail_message_subtype,base.group_user,1,1,1,1
+access_mail_message_subtype_user,mail.message.subtype.user,model_mail_message_subtype,base.group_user,1,0,0,0
+access_mail_message_subtype_system,mail.message.subtype.system,model_mail_message_subtype,base.group_system,1,1,1,1
 access_mail_tracking_value_all,mail.tracking.value.all,model_mail_tracking_value,,0,0,0,0
 access_mail_tracking_value_portal,mail.tracking.value.portal,model_mail_tracking_value,base.group_portal,0,0,0,0
 access_mail_tracking_value_user,mail.tracking.value.user,model_mail_tracking_value,base.group_user,0,0,0,0
diff --git a/addons/test_mail/tests/__init__.py b/addons/test_mail/tests/__init__.py
index bccb72c373e..bd325b1003e 100644
--- a/addons/test_mail/tests/__init__.py
+++ b/addons/test_mail/tests/__init__.py
@@ -19,3 +19,4 @@ from . import test_message_track
 from . import test_performance
 from . import test_ui
 from . import test_mail_management
+from . import test_mail_security
diff --git a/addons/test_mail/tests/test_mail_message.py b/addons/test_mail/tests/test_mail_message.py
index 1789277374e..005976f4d74 100644
--- a/addons/test_mail/tests/test_mail_message.py
+++ b/addons/test_mail/tests/test_mail_message.py
@@ -70,7 +70,7 @@ class TestMessageValues(MailCommon):
         self.assertFalse(message.sudo()._filter_empty(), 'Still having attachments')
 
         # Subtype content
-        note_subtype.write({'description': 'Very important discussions'})
+        note_subtype.sudo().write({'description': 'Very important discussions'})
         record._message_update_content(message, '', [])
         self.assertFalse(message.attachment_ids)
         self.assertEqual(message.notified_partner_ids, self.partner_admin)
@@ -78,7 +78,7 @@ class TestMessageValues(MailCommon):
         self.assertFalse(message.sudo()._filter_empty(), 'Subtype with description')
 
         # Completely void now
-        note_subtype.write({'description': ''})
+        note_subtype.sudo().write({'description': ''})
         self.assertEqual(message.sudo()._filter_empty(), message)
         record._message_update_content(message, '', [])
         self.assertFalse(message.notified_partner_ids)
diff --git a/addons/test_mail/tests/test_mail_security.py b/addons/test_mail/tests/test_mail_security.py
new file mode 100644
index 00000000000..8b8bfde7c92
--- /dev/null
+++ b/addons/test_mail/tests/test_mail_security.py
@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo.addons.mail.tests.common import mail_new_test_user, MailCommon
+from odoo.exceptions import AccessError
+
+
+class TestSubtypeAccess(MailCommon):
+
+    def test_subtype_access(self):
+        """
+        The function aims to formally verify the access restrictions on mail.message.subtype for
+        normal and admin users. It ensures that normal users are unable to modify it,
+        while admin users possess the necessary privileges to modify it successfully.
+        """
+
+        test_subtype = self.env['mail.message.subtype'].create({
+            'name': 'Test',
+            'description': 'only description',
+        })
+
+        user = mail_new_test_user(self.env, 'Internal user', groups='base.group_user')
+
+        with self.assertRaises(AccessError):
+            test_subtype.with_user(user).write({'description': 'changing description'})
+
+        test_subtype.with_user(self.user_admin).write({'description': 'testing'})
+        self.assertEqual(test_subtype.description, 'testing')