diff --git a/api4/status.go b/api4/status.go
index 6ab4df139a..b6118990f9 100644
--- a/api4/status.go
+++ b/api4/status.go
@@ -45,6 +45,13 @@ func getUserStatusesByIds(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	for _, userId := range userIds {
+		if len(userId) != 26 {
+			c.SetInvalidParam("user_ids")
+			return
+		}
+	}
+
 	// No permission check required
 
 	statusMap, err := c.App.GetUserStatusesByIds(userIds)
diff --git a/api4/status_test.go b/api4/status_test.go
index 0b5dd01b90..70eb52d7e8 100644
--- a/api4/status_test.go
+++ b/api4/status_test.go
@@ -58,7 +58,6 @@ func TestGetUserStatus(t *testing.T) {
 
 	t.Run("get status from logged out user", func(t *testing.T) {
 		Client.Logout()
-
 		_, resp := Client.GetUserStatus(th.BasicUser2.Id, "")
 		CheckUnauthorizedStatus(t, resp)
 	})
@@ -83,6 +82,16 @@ func TestGetUsersStatusesByIds(t *testing.T) {
 		CheckBadRequestStatus(t, resp)
 	})
 
+	t.Run("completely invalid userIds list", func(t *testing.T) {
+		_, resp := Client.GetUsersStatusesByIds([]string{"invalid_user_id", "invalid_user_id"})
+		CheckBadRequestStatus(t, resp)
+	})
+
+	t.Run("partly invalid userIds list", func(t *testing.T) {
+		_, resp := Client.GetUsersStatusesByIds([]string{th.BasicUser.Id, "invalid_user_id"})
+		CheckBadRequestStatus(t, resp)
+	})
+
 	t.Run("offline status", func(t *testing.T) {
 		usersStatuses, resp := Client.GetUsersStatusesByIds(usersIds)
 		CheckNoError(t, resp)