diff --git a/changelog/unreleased/prevent-thumbnailer-from-showing-secureview-previews.md b/changelog/unreleased/prevent-thumbnailer-from-showing-secureview-previews.md
new file mode 100644
index 000000000..686bd6ea9
--- /dev/null
+++ b/changelog/unreleased/prevent-thumbnailer-from-showing-secureview-previews.md
@@ -0,0 +1,6 @@
+Bugfix: Don't show thumbnails for secureview shares
+
+We have fixed a bug where thumbnails were shown for secureview shares.
+
+https://github.com/owncloud/ocis/pull/9299
+https://github.com/owncloud/ocis/issues/9249
diff --git a/services/thumbnails/pkg/service/grpc/v0/service.go b/services/thumbnails/pkg/service/grpc/v0/service.go
index 5982b1ca4..4de5e5adb 100644
--- a/services/thumbnails/pkg/service/grpc/v0/service.go
+++ b/services/thumbnails/pkg/service/grpc/v0/service.go
@@ -123,6 +123,10 @@ func (g Thumbnail) handleCS3Source(ctx context.Context, req *thumbnailssvc.GetTh
 		return "", err
 	}
 
+	if !sRes.GetInfo().GetPermissionSet().GetInitiateFileDownload() {
+		return "", merrors.Forbidden(g.serviceID, "no download permission")
+	}
+
 	tType := thumbnail.GetExtForMime(sRes.GetInfo().GetMimeType())
 	if tType == "" {
 		tType = req.GetThumbnailType().String()
@@ -206,6 +210,10 @@ func (g Thumbnail) handleWebdavSource(ctx context.Context, req *thumbnailssvc.Ge
 		return "", err
 	}
 
+	if !sRes.GetInfo().GetPermissionSet().GetInitiateFileDownload() {
+		return "", merrors.Forbidden(g.serviceID, "no download permission")
+	}
+
 	tType := thumbnail.GetExtForMime(sRes.GetInfo().GetMimeType())
 	if tType == "" {
 		tType = req.GetThumbnailType().String()
diff --git a/services/webdav/pkg/service/v0/service.go b/services/webdav/pkg/service/v0/service.go
index d0da62fce..97d3656a3 100644
--- a/services/webdav/pkg/service/v0/service.go
+++ b/services/webdav/pkg/service/v0/service.go
@@ -261,6 +261,8 @@ func (g Webdav) SpacesThumbnail(w http.ResponseWriter, r *http.Request) {
 			return
 		case http.StatusBadRequest:
 			renderError(w, r, errBadRequest(e.Detail))
+		case http.StatusForbidden:
+			renderError(w, r, errPermissionDenied(e.Detail))
 		default:
 			renderError(w, r, errInternalError(err.Error()))
 		}