diff --git a/addons/mail/controllers/webclient.py b/addons/mail/controllers/webclient.py
index babde9c9c6a..8fc74de1f70 100644
--- a/addons/mail/controllers/webclient.py
+++ b/addons/mail/controllers/webclient.py
@@ -20,4 +20,6 @@ class WebclientController(http.Controller):
 
     @http.route("/mail/load_message_failures", methods=["POST"], type="json", auth="user")
     def mail_load_message_failures(self):
-        return request.env.user.sudo(False).partner_id._message_fetch_failed()
+        # sudo as to not check ACL, which is far too costly
+        # sudo: res.users - return only failures of current user as author
+        return request.env.user.partner_id._message_fetch_failed()