diff --git a/models/lists.js b/models/lists.js
index 8114ff5cb..d9a5b8e2a 100644
--- a/models/lists.js
+++ b/models/lists.js
@@ -147,9 +147,9 @@ if (Meteor.isServer) {
   });
 
   JsonRoutes.add('GET', '/api/boards/:boardId/lists/:listId', function (req, res, next) {
-    Authentication.checkUserId( req.userId);
     const paramBoardId = req.params.boardId;
     const paramListId = req.params.listId;
+    Authentication.checkBoardAccess( req.userId, paramBoardId);
     JsonRoutes.sendResult(res, {
       code: 200,
       data: Lists.findOne({ _id: paramListId, boardId: paramBoardId, archived: false }),