diff --git a/src/backend/ssh/host-resolver.ts b/src/backend/ssh/host-resolver.ts
index f0e32ce7..dec983db 100644
--- a/src/backend/ssh/host-resolver.ts
+++ b/src/backend/ssh/host-resolver.ts
@@ -20,6 +20,14 @@ export async function resolveHostById(
   hostId: number,
   userId: string,
 ): Promise<SSHHost | null> {
+  const { PermissionManager } = await import("../utils/permission-manager.js");
+  const access = await PermissionManager.getInstance().canAccessHost(
+    userId,
+    hostId,
+    "read",
+  );
+  if (!access.hasAccess) return null;
+
   const db = getDb();
 
   const hostResults = await SimpleDBOps.select(