diff --git a/services/nginx/app/routes/moduleSelfServeRoute.php b/services/nginx/app/routes/moduleSelfServeRoute.php
index e05e02eb..d69c70ae 100644
--- a/services/nginx/app/routes/moduleSelfServeRoute.php
+++ b/services/nginx/app/routes/moduleSelfServeRoute.php
@@ -459,6 +459,11 @@ class moduleSelfServeRoute
             self::requireType($commandParam, self::type_string());
             // Get the lane and command
             $lane = $selfserve->lane($lane_id);
+            // Require access to the lane's department to prevent cross-department command execution
+            if (empty($lane->department_lane) || empty($lane->department_lane->department)) {
+                $response->error('Lane department not found', 404);
+            }
+            self::requireDepartmentAccess((string)$lane->department_lane->department->value());
             // If the user has the bypass permission, set the lane to bypass customer number validation
             if (self::hasPermission('modules_selfserve_lane_command_bypass_customer_number_validation')) {
                 $lane->setBypassCustomerNumberValidation(true);