diff --git a/backend/open_webui/routers/images.py b/backend/open_webui/routers/images.py
index 465893580b..951fd905e7 100644
--- a/backend/open_webui/routers/images.py
+++ b/backend/open_webui/routers/images.py
@@ -768,6 +768,28 @@ class EditImageForm(BaseModel):
 
 
 @router.post('/edit')
+async def edit_images(request: Request, form_data: EditImageForm, user=Depends(get_verified_user)):
+    # Authorize the direct route like /generations and the edit_image tool: enforce the
+    # global image-edit switch and the per-user image-generation permission. The internal
+    # callers (edit_image tool, chat middleware) gate themselves and call image_edits()
+    # directly, so they are unaffected by this wrapper.
+    if not request.app.state.config.ENABLE_IMAGE_EDIT:
+        raise HTTPException(
+            status_code=403,
+            detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
+        )
+
+    if user.role != 'admin' and not await has_permission(
+        user.id, 'features.image_generation', request.app.state.config.USER_PERMISSIONS
+    ):
+        raise HTTPException(
+            status_code=403,
+            detail=ERROR_MESSAGES.ACCESS_PROHIBITED,
+        )
+
+    return await image_edits(request, form_data, user=user)
+
+
 async def image_edits(
     request: Request,
     form_data: EditImageForm,