diff --git a/addons/account/controllers/portal.py b/addons/account/controllers/portal.py
index 9766b27c276..44355f227f8 100644
--- a/addons/account/controllers/portal.py
+++ b/addons/account/controllers/portal.py
@@ -15,7 +15,7 @@ class PortalAccount(CustomerPortal):
         if 'invoice_count' in counters:
             invoice_count = request.env['account.move'].search_count([
                 ('move_type', 'in', ('out_invoice', 'in_invoice', 'out_refund', 'in_refund', 'out_receipt', 'in_receipt')),
-            ])
+            ]) if request.env['account.move'].check_access_rights('read', raise_exception=False) else 0
             values['invoice_count'] = invoice_count
         return values
 
diff --git a/addons/purchase/controllers/portal.py b/addons/purchase/controllers/portal.py
index 45ab7d037b9..58830772074 100644
--- a/addons/purchase/controllers/portal.py
+++ b/addons/purchase/controllers/portal.py
@@ -22,7 +22,7 @@ class CustomerPortal(portal.CustomerPortal):
         if 'purchase_count' in counters:
             values['purchase_count'] = request.env['purchase.order'].search_count([
                 ('state', 'in', ['purchase', 'done', 'cancel'])
-            ])
+            ]) if request.env['purchase.order'].check_access_rights('read', raise_exception=False) else 0
         return values
 
     def _purchase_order_get_page_view_values(self, order, access_token, **kwargs):
diff --git a/addons/sale/controllers/portal.py b/addons/sale/controllers/portal.py
index 360fb63dd54..880200348f2 100644
--- a/addons/sale/controllers/portal.py
+++ b/addons/sale/controllers/portal.py
@@ -24,12 +24,12 @@ class CustomerPortal(portal.CustomerPortal):
             values['quotation_count'] = SaleOrder.search_count([
                 ('message_partner_ids', 'child_of', [partner.commercial_partner_id.id]),
                 ('state', 'in', ['sent', 'cancel'])
-            ])
+            ]) if SaleOrder.check_access_rights('read', raise_exception=False) else 0
         if 'order_count' in counters:
             values['order_count'] = SaleOrder.search_count([
                 ('message_partner_ids', 'child_of', [partner.commercial_partner_id.id]),
                 ('state', 'in', ['sale', 'done'])
-            ])
+            ]) if SaleOrder.check_access_rights('read', raise_exception=False) else 0
 
         return values