diff --git a/application/controllers/UserController.php b/application/controllers/UserController.php
index 5a5b3c754..c10b19b53 100644
--- a/application/controllers/UserController.php
+++ b/application/controllers/UserController.php
@@ -170,6 +170,7 @@ class UserController extends AuthBackendController
         $admissionLoader = new AdmissionLoader();
         $admissionLoader->applyRoles($userObj);
         $this->view->userObj = $userObj;
+        $this->view->allowedToEditRoles = $this->hasPermission('config/authentication/roles/edit');
     }
 
     /**
diff --git a/application/views/scripts/user/show.phtml b/application/views/scripts/user/show.phtml
index aaeffd51e..af54912d2 100644
--- a/application/views/scripts/user/show.phtml
+++ b/application/views/scripts/user/show.phtml
@@ -43,22 +43,27 @@ use Icinga\Data\Selectable;
         <tr>
             <th><?= $this->translate('Role Memberships'); ?></th>
             <td>
-                <?php $roleObj =  $userObj->getRoles(); ?>
-                <?php if (! empty($roleObj)): ?>
-                    <ul class="role-memberships">
-                        <?php foreach($roleObj as $role): ?>
-                            <li><?= $this->qlink(
-                                    $role->getName(),
-                                    'role/edit',
-                                    ['role' => $role->getName()],
-                                    ['title' => sprintf($this->translate('Edit role %s'), $role->getName())]
-                                ) ?>
-                            </li>
-                        <?php endforeach ?>
-                    </ul>
-                <?php else: ?>
-                    <p><?= $this->translate('No memberships found'); ?></p>
-                <?php endif ?>
+            <?php $roleObj =  $userObj->getRoles(); ?>
+            <?php if (! empty($roleObj)): ?>
+                <ul class="role-memberships">
+                <?php foreach($roleObj as $role): ?>
+                    <li>
+                    <?php if ($this->allowedToEditRoles): ?>
+                        <?= $this->qlink(
+                            $role->getName(),
+                            'role/edit',
+                            ['role' => $role->getName()],
+                            ['title' => sprintf($this->translate('Edit role %s'), $role->getName())]
+                        ) ?>
+                    <?php else: ?>
+                        <?= $role->getName() ?>
+                    <?php endif ?>
+                    </li>
+                <?php endforeach ?>
+                </ul>
+            <?php else: ?>
+                <p><?= $this->translate('No memberships found'); ?></p>
+            <?php endif ?>
             </td>
         </tr>
     </table>