diff --git a/api4/post.go b/api4/post.go
index b6d2483d5f..4d379f9097 100644
--- a/api4/post.go
+++ b/api4/post.go
@@ -195,12 +195,37 @@ func getFlaggedPostsForUser(c *Context, w http.ResponseWriter, r *http.Request)
 		posts, err = c.App.GetFlaggedPosts(c.Params.UserId, c.Params.Page, c.Params.PerPage)
 	}
 
+	pl := model.NewPostList()
+	channelReadPermission := make(map[string]bool)
+
+	for _, post := range posts.Posts {
+		allowed, ok := channelReadPermission[post.ChannelId]
+
+		if !ok {
+			allowed = false
+
+			if c.App.SessionHasPermissionToChannel(c.App.Session, post.ChannelId, model.PERMISSION_READ_CHANNEL) {
+				allowed = true
+			}
+
+			channelReadPermission[post.ChannelId] = allowed
+		}
+
+		if !allowed {
+			continue
+		}
+
+		pl.AddPost(post)
+		pl.AddOrder(post.Id)
+
+	}
+
 	if err != nil {
 		c.Err = err
 		return
 	}
 
-	w.Write([]byte(c.App.PreparePostListForClient(posts).ToJson()))
+	w.Write([]byte(c.App.PreparePostListForClient(pl).ToJson()))
 }
 
 func getPost(c *Context, w http.ResponseWriter, r *http.Request) {
diff --git a/api4/post_test.go b/api4/post_test.go
index 07e0d862c9..8b85b5f222 100644
--- a/api4/post_test.go
+++ b/api4/post_test.go
@@ -912,9 +912,11 @@ func TestGetFlaggedPostsForUser(t *testing.T) {
 		Name:     post1.Id,
 		Value:    "true",
 	}
-	Client.UpdatePreferences(user.Id, &model.Preferences{preference})
+	_, resp := Client.UpdatePreferences(user.Id, &model.Preferences{preference})
+	CheckNoError(t, resp)
 	preference.Name = post2.Id
-	Client.UpdatePreferences(user.Id, &model.Preferences{preference})
+	_, resp = Client.UpdatePreferences(user.Id, &model.Preferences{preference})
+	CheckNoError(t, resp)
 
 	opl := model.NewPostList()
 	opl.AddPost(post1)
@@ -1049,6 +1051,66 @@ func TestGetFlaggedPostsForUser(t *testing.T) {
 		t.Fatal("should be empty")
 	}
 
+	channel4 := th.CreateChannelWithClient(th.SystemAdminClient, model.CHANNEL_PRIVATE)
+	post5 := th.CreatePostWithClient(th.SystemAdminClient, channel4)
+
+	preference.Name = post5.Id
+	_, resp = Client.UpdatePreferences(user.Id, &model.Preferences{preference})
+	CheckForbiddenStatus(t, resp)
+
+	rpl, resp = Client.GetFlaggedPostsForUser(user.Id, 0, 10)
+	CheckNoError(t, resp)
+
+	if len(rpl.Posts) != 3 {
+		t.Fatal("should have returned 3 posts")
+	}
+
+	if !reflect.DeepEqual(rpl.Posts, opl.Posts) {
+		t.Fatal("posts should have matched")
+	}
+
+	th.AddUserToChannel(user, channel4)
+	_, resp = Client.UpdatePreferences(user.Id, &model.Preferences{preference})
+	CheckNoError(t, resp)
+
+	rpl, resp = Client.GetFlaggedPostsForUser(user.Id, 0, 10)
+	CheckNoError(t, resp)
+
+	opl.AddPost(post5)
+	opl.AddOrder(post5.Id)
+
+	if len(rpl.Posts) != 4 {
+		t.Fatal("should have returned 4 posts")
+	}
+
+	if !reflect.DeepEqual(rpl.Posts, opl.Posts) {
+		t.Fatal("posts should have matched")
+	}
+
+	err := th.App.RemoveUserFromChannel(user.Id, "", channel4)
+	if err != nil {
+		t.Error("Unable to remove user from channel")
+	}
+
+	rpl, resp = Client.GetFlaggedPostsForUser(user.Id, 0, 10)
+	CheckNoError(t, resp)
+
+	opl2 := model.NewPostList()
+	opl2.AddPost(post1)
+	opl2.AddOrder(post1.Id)
+	opl2.AddPost(post2)
+	opl2.AddOrder(post2.Id)
+	opl2.AddPost(post4)
+	opl2.AddOrder(post4.Id)
+
+	if len(rpl.Posts) != 3 {
+		t.Fatal("should have returned 3 posts")
+	}
+
+	if !reflect.DeepEqual(rpl.Posts, opl2.Posts) {
+		t.Fatal("posts should have matched")
+	}
+
 	_, resp = Client.GetFlaggedPostsForUser("junk", 0, 10)
 	CheckBadRequestStatus(t, resp)
 
diff --git a/api4/preference.go b/api4/preference.go
index 80d067cb53..c10ca44312 100644
--- a/api4/preference.go
+++ b/api4/preference.go
@@ -94,7 +94,26 @@ func updatePreferences(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := c.App.UpdatePreferences(c.Params.UserId, preferences); err != nil {
+	var sanitizedPreferences model.Preferences
+
+	for _, pref := range preferences {
+		if pref.Category == model.PREFERENCE_CATEGORY_FLAGGED_POST {
+			post, err := c.App.GetSinglePost(pref.Name)
+			if err != nil {
+				c.SetInvalidParam("preference.name")
+				return
+			}
+
+			if !c.App.SessionHasPermissionToChannel(c.App.Session, post.ChannelId, model.PERMISSION_READ_CHANNEL) {
+				c.SetPermissionError(model.PERMISSION_READ_CHANNEL)
+				return
+			}
+		}
+
+		sanitizedPreferences = append(sanitizedPreferences, pref)
+	}
+
+	if err := c.App.UpdatePreferences(c.Params.UserId, sanitizedPreferences); err != nil {
 		c.Err = err
 		return
 	}