diff --git a/addons/web_tour/models/tour.py b/addons/web_tour/models/tour.py
index ccf6968fd63..339506d3874 100644
--- a/addons/web_tour/models/tour.py
+++ b/addons/web_tour/models/tour.py
@@ -17,8 +17,12 @@ class Tour(models.Model):
     def consume(self, tour_names):
         """ Sets given tours as consumed, meaning that
             these tours won't be active anymore for that user """
+        if not self.env.user.has_group('base.group_user'):
+            # Only internal users can use this method.
+            # TODO master: update ir.model.access records instead of using sudo()
+            return
         for name in tour_names:
-            self.create({'name': name, 'user_id': self.env.uid})
+            self.sudo().create({'name': name, 'user_id': self.env.uid})
 
     @api.model
     def get_consumed_tours(self):