diff --git a/api/kiwi_vpn_api/db/user.py b/api/kiwi_vpn_api/db/user.py
index 33153e4..e150218 100644
--- a/api/kiwi_vpn_api/db/user.py
+++ b/api/kiwi_vpn_api/db/user.py
@@ -184,6 +184,7 @@ class User(UserBase, table=True):
 
         return (
             capability in self.get_capabilities()
+            # admin can do everything
             or UserCapabilityType.admin in self.get_capabilities()
         )
 
diff --git a/api/kiwi_vpn_api/routers/_common.py b/api/kiwi_vpn_api/routers/_common.py
index 91def45..d692054 100644
--- a/api/kiwi_vpn_api/routers/_common.py
+++ b/api/kiwi_vpn_api/routers/_common.py
@@ -84,7 +84,7 @@ async def get_current_user_if_exists(
 
     # fail if not requested by a user
     if current_user is None:
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND)
 
     return current_user