diff --git a/packages/helpermodules/command.py b/packages/helpermodules/command.py
index 11ee114bf1..a2f44cabb8 100644
--- a/packages/helpermodules/command.py
+++ b/packages/helpermodules/command.py
@@ -1206,6 +1206,11 @@ def addConsumer(self, connection_id: str, payload: dict) -> None:
         Pub().pub(f"openWB/set/consumer/{new_id}/usage", asdict(Usage(type=consumer_default["usage"][0])))
         self.max_id_hierarchy = new_id
         Pub().pub("openWB/set/command/max_id/hierarchy", new_id)
+        # add ACL roles for consumer access, if user management is active
+        if SubData.system_data["system"].data["security"]["user_management_active"]:
+            add_acl_role("consumer-<id>-access", new_id)
+            if consumer_default["type"] == "mqtt":
+                add_acl_role("consumer-<id>-write-access", new_id)
         pub_user_message(
             payload, connection_id,
             f'Neues Gerät vom Typ \'{payload["data"]["type"]}\' mit ID \'{new_id}\' hinzugefügt.',
@@ -1224,6 +1229,10 @@ def removeConsumer(self, connection_id: str, payload: dict) -> None:
         Pub().pub("openWB/set/counter/get/hierarchy", SubData.counter_all_data.data.get.hierarchy)
         SubData.counter_all_data.remove_loadmanagement_prio_item(ComponentType.CONSUMER, payload["data"]["consumer_id"])
         Pub().pub("openWB/set/counter/get/loadmanagement_prios", SubData.counter_all_data.data.get.loadmanagement_prios)
+        # remove ACL roles for consumer access, if user management is active
+        if SubData.system_data["system"].data["security"]["user_management_active"]:
+            remove_acl_role("consumer-<id>-access", payload["data"]["consumer_id"])
+            remove_acl_role("consumer-<id>-write-access", payload["data"]["consumer_id"])
         pub_user_message(payload, connection_id,
                          f'Verbraucher mit ID \'{payload["data"]["consumer_id"]}\' gelöscht.', MessageType.SUCCESS)
 
diff --git a/packages/helpermodules/mosquitto_dynsec/mosquitto_dynsec.py b/packages/helpermodules/mosquitto_dynsec/mosquitto_dynsec.py
index 4ce48b9b65..f131d2e485 100644
--- a/packages/helpermodules/mosquitto_dynsec/mosquitto_dynsec.py
+++ b/packages/helpermodules/mosquitto_dynsec/mosquitto_dynsec.py
@@ -143,6 +143,10 @@ def check_roles_at_start():
                 add_acl_role("vehicle-<id>-access", ev.num)
                 if ev.soc_module is not None and ev.soc_module.vehicle_config.type == "mqtt":
                     add_acl_role("vehicle-<id>-write-access", ev.num)
+            for consumer in SubData.consumer_data.values():
+                add_acl_role("consumer-<id>-access", consumer.num)
+                if consumer.data.module is not None and consumer.data.module.type == "mqtt":
+                    add_acl_role("consumer-<id>-write-access", consumer.num)
             for io_action in SubData.io_actions.actions.values():
                 add_acl_role("io-action-<id>-access", io_action.config.id)
             for key, value in SubData.system_data.items():
diff --git a/packages/helpermodules/update_config.py b/packages/helpermodules/update_config.py
index 40871f51ee..5777eb80e8 100644
--- a/packages/helpermodules/update_config.py
+++ b/packages/helpermodules/update_config.py
@@ -32,6 +32,7 @@
 from helpermodules.measurement_logging.process_log import get_default_charge_log_columns, get_totals
 from helpermodules.measurement_logging.write_log import get_names
 from helpermodules.messaging import MessageType, pub_system_message
+from helpermodules.mosquitto_dynsec.role_handler import add_acl_role, remove_acl_role
 from helpermodules.pub import Pub
 from helpermodules.utils.json_file_handler import write_and_check
 from helpermodules.utils.run_command import run_command
@@ -61,7 +62,7 @@
 
 class UpdateConfig:
 
-    DATASTORE_VERSION = 151
+    DATASTORE_VERSION = 152
 
     FILE_OPERATION_VERSION = 0
 
@@ -4049,3 +4050,23 @@ def upgrade_datastore_151(self):
             self.__update_topic(hierarchy_topic, _counter_all.data.get.hierarchy)
 
         self._append_datastore_version(151)
+
+    def upgrade_datastore_152(self):
+        user_management_active = decode_payload(
+            self.all_received_topics.get("openWB/system/security/user_management_active")
+        )
+        if user_management_active is True:
+            for topic, payload in self.all_received_topics.items():
+                match = re.search(r"^openWB/consumer/(\d+)/module$", topic)
+                if match is None:
+                    continue
+                consumer_id = int(match.group(1))
+                consumer_module = decode_payload(payload)
+                consumer_type = consumer_module.get("type") if isinstance(consumer_module, dict) else None
+
+                add_acl_role("consumer-<id>-access", consumer_id)
+                if consumer_type == "mqtt":
+                    add_acl_role("consumer-<id>-write-access", consumer_id)
+                else:
+                    remove_acl_role("consumer-<id>-write-access", consumer_id)
+        self._append_datastore_version(152)