diff --git a/addons/mail/i18n/mail.pot b/addons/mail/i18n/mail.pot
index 7932f0d72d6..7589049b357 100644
--- a/addons/mail/i18n/mail.pot
+++ b/addons/mail/i18n/mail.pot
@@ -1562,6 +1562,12 @@ msgstr ""
 msgid "Customer is required for inbox / email notification"
 msgstr ""
 
+#. module: mail
+#: code:addons/mail/models/mail_notification.py:0
+#, python-format
+msgid "Can not update the message or recipient of a notification."
+msgstr ""
+
 #. module: mail
 #: model:ir.model.fields,field_description:mail.field_mail_mail__date
 #: model:ir.model.fields,field_description:mail.field_mail_message__date
diff --git a/addons/mail/models/mail_notification.py b/addons/mail/models/mail_notification.py
index 44f03184f0d..5e87c6ac990 100644
--- a/addons/mail/models/mail_notification.py
+++ b/addons/mail/models/mail_notification.py
@@ -4,6 +4,7 @@
 from dateutil.relativedelta import relativedelta
 
 from odoo import api, fields, models
+from odoo.exceptions import AccessError
 from odoo.tools.translate import _
 
 
@@ -58,12 +59,17 @@ class MailNotification(models.Model):
 
     @api.model_create_multi
     def create(self, vals_list):
+        messages = self.env['mail.message'].browse(vals['mail_message_id'] for vals in vals_list)
+        messages.check_access_rights('read')
+        messages.check_access_rule('read')
         for vals in vals_list:
             if vals.get('is_read'):
                 vals['read_date'] = fields.Datetime.now()
         return super(MailNotification, self).create(vals_list)
 
     def write(self, vals):
+        if ('mail_message_id' in vals or 'res_partner_id' in vals) and not self.env.is_admin():
+            raise AccessError(_("Can not update the message or recipient of a notification."))
         if vals.get('is_read'):
             vals['read_date'] = fields.Datetime.now()
         return super(MailNotification, self).write(vals)