diff --git a/addons/portal/controllers/mail.py b/addons/portal/controllers/mail.py
index 110821d0174..411106dc188 100644
--- a/addons/portal/controllers/mail.py
+++ b/addons/portal/controllers/mail.py
@@ -52,12 +52,14 @@ def _message_post_helper(res_model, res_id, message, token='', nosubscribe=True,
     """
     record = request.env[res_model].browse(res_id)
 
-    # check if user can post
-    pid = int(kw['pid']) if kw.get('pid') else False
-    if _check_special_access(res_model, res_id, token=token, _hash=kw.get('hash'), pid=pid):
-        record = record.sudo()
-    else:
-        raise Forbidden()
+    # check if user can post with special token/signed token. The "else" will try to post message with the
+    # current user access rights (_mail_post_access use case).
+    if token or (kw.get('hash') and kw.get('pid')):
+        pid = int(kw['pid']) if kw.get('pid') else False
+        if _check_special_access(res_model, res_id, token=token, _hash=kw.get('hash'), pid=pid):
+            record = record.sudo()
+        else:
+            raise Forbidden()
 
     # deduce author of message
     author_id = request.env.user.partner_id.id if request.env.user.partner_id else False