diff --git a/addons/project/security/ir.model.access.csv b/addons/project/security/ir.model.access.csv
index 38032cf4c6b..c4794bbbada 100644
--- a/addons/project/security/ir.model.access.csv
+++ b/addons/project/security/ir.model.access.csv
@@ -31,11 +31,11 @@ access_project_task_recurrence,project.task.recurrence,model_project_task_recurr
 project.access_project_task_burndown_chart_report,access_project_task_burndown_chart_report,project.model_project_task_burndown_chart_report,project.group_project_manager,1,1,1,1
 project.access_project_task_burndown_chart_report_user,access_project_task_burndown_chart_report_user,project.model_project_task_burndown_chart_report,project.group_project_user,1,0,0,0
 access_project_update_user,project.update.user,model_project_update,base.group_user,1,0,0,0
-access_project_update_portal,project.update.portal,model_project_update,base.group_portal,1,0,0,0
+access_project_update_portal,project.update.portal,model_project_update,base.group_portal,0,0,0,0
 access_project_update_project_user,project.update.project.user,model_project_update,project.group_project_user,1,1,1,1
 access_project_update_project_manager,project.update.project.manager,model_project_update,project.group_project_manager,1,1,1,1
 access_project_milestone_user,project.milestone.user,model_project_milestone,base.group_user,1,0,0,0
-access_project_milestone_portal,project.milestone.portal,model_project_milestone,base.group_portal,1,0,0,0
+access_project_milestone_portal,project.milestone.portal,model_project_milestone,base.group_portal,0,0,0,0
 access_project_milestone_project_user,project.milestone.project.user,model_project_milestone,project.group_project_user,1,1,1,1
 access_project_milestone_project_manager,project.milestone.project.manager,model_project_milestone,project.group_project_manager,1,1,1,1
 access_project_collaborator_manager,project.collaborator.manager,model_project_collaborator,project.group_project_manager,1,1,1,1
diff --git a/addons/project/tests/test_project_update_access_rights.py b/addons/project/tests/test_project_update_access_rights.py
index 747ea83c3ab..986bd3abc30 100644
--- a/addons/project/tests/test_project_update_access_rights.py
+++ b/addons/project/tests/test_project_update_access_rights.py
@@ -17,9 +17,14 @@ class TestProjectUpdateAccessRights(TestProjectCommon):
             'project_id': cls.project_pigs.id,
             'status': 'on_track',
         })
+        cls.project_milestone = cls.env['project.milestone'].create({
+            'name': 'Test Projec Milestone',
+            'project_id': cls.project_pigs.id,
+        })
         cls.base_user = mail_new_test_user(cls.env, 'Base user', groups='base.group_user')
         cls.project_user = mail_new_test_user(cls.env, 'Project user', groups='project.group_project_user')
         cls.project_manager = mail_new_test_user(cls.env, 'Project admin', groups='project.group_project_manager')
+        cls.portal_user = mail_new_test_user(cls.env, 'Portal user', groups='base.group_portal')
 
     @users('Project user', 'Project admin', 'Base user')
     def test_project_update_user_can_read(self):
@@ -42,3 +47,50 @@ class TestProjectUpdateAccessRights(TestProjectCommon):
     @users('Project admin')
     def test_project_update_admin_unlink(self):
         self.project_update_1.with_user(self.env.user).unlink()
+
+    @users('Portal user')
+    def test_project_update_portal_user_no_read(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to read in the project update"):
+            self.project_update_1.with_user(self.env.user).name
+
+    @users('Portal user')
+    def test_project_update_portal_user_no_write(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to write in the project update"):
+            self.project_update_1.with_user(self.env.user).name = 'Test write'
+
+    @users('Portal user')
+    def test_project_update_portal_user_no_create(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to create in the project update model"):
+            self.env['project.update'].with_user(self.env.user).create({
+                'name': 'Test Create with portal user',
+                'project_id': self.project_pigs.id,
+                'state': 'on_track',
+            })
+
+    @users('Portal user')
+    def test_project_update_portal_user_no_unlink(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to unlink in the project update"):
+            self.project_update_1.with_user(self.env.user).unlink()
+
+    @users('Portal user')
+    def test_project_milestone_portal_user_no_read(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to read in the project update"):
+            self.project_milestone.with_user(self.env.user).name
+
+    @users('Portal user')
+    def test_project_milestone_portal_user_no_write(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to write in the project update"):
+            self.project_milestone.with_user(self.env.user).name = 'Test write'
+
+    @users('Portal user')
+    def test_project_milestone_portal_user_no_create(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to create in the project update model"):
+            self.env['project.update'].with_user(self.env.user).create({
+                'name': 'Test Create with portal user',
+                'project_id': self.project_pigs.id,
+            })
+
+    @users('Portal user')
+    def test_project_milestone_portal_user_no_unlink(self):
+        with self.assertRaises(AccessError, msg=f"{self.env.user.name} should not be able to unlink in the project update"):
+            self.project_milestone.with_user(self.env.user).unlink()