diff --git a/CHANGELOG.md b/CHANGELOG.md
index f3456104..02799630 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 ### Fixed
 
 - Fixed a bug that prevented the creation of additional field data for objects
+- Hide config menu if user does not have read permission
 
 ## [1.23.0] - 2025-11-05
 
diff --git a/setup.php b/setup.php
index f67d3a30..2c714923 100644
--- a/setup.php
+++ b/setup.php
@@ -126,8 +126,10 @@ function plugin_init_fields()
             // add link in plugin page
             $PLUGIN_HOOKS['config_page']['fields'] = 'front/container.php';
 
-            // add entry to configuration menu
-            $PLUGIN_HOOKS['menu_toadd']['fields'] = ['config' => 'PluginFieldsMenu'];
+            // add entry to configuration menu (only if user has read access to config)
+            if (Session::haveRight('config', READ)) {
+                $PLUGIN_HOOKS['menu_toadd']['fields'] = ['config' => 'PluginFieldsMenu'];
+            }
 
             // add tabs to itemtypes
             $itemtypes = array_unique(PluginFieldsContainer::getEntries());