--- a/src/pyams_content/profile/admin.py	Mon Jan 18 16:11:40 2016 +0100
+++ b/src/pyams_content/profile/admin.py	Mon Jan 18 17:29:16 2016 +0100
@@ -18,12 +18,14 @@
 # import interfaces
 from pyams_content.profile.interfaces import IAdminProfile, ADMIN_PROFILE_KEY
 from pyams_security.interfaces import IPrincipalInfo
+from pyams_utils.interfaces import PUBLIC_PERMISSION
 from zope.annotation.interfaces import IAnnotations, IAttributeAnnotatable
 
 # import packages
 from persistent import Persistent
 from pyams_utils.adapter import adapter_config
-from pyams_utils.request import check_request
+from pyams_utils.request import check_request, query_request
+from pyramid.security import Allow, ALL_PERMISSIONS, Everyone
 from pyramid.threadlocal import get_current_registry
 from zope.lifecycleevent import ObjectCreatedEvent
 from zope.interface import implementer, Interface
@@ -37,6 +39,14 @@
     favorites = FieldProperty(IAdminProfile['favorites'])
     table_page_length = FieldProperty(IAdminProfile['table_page_length'])
 
+    def __acl__(self):
+        result = [(Allow, 'system:admin', ALL_PERMISSIONS)]
+        request = query_request()
+        if request is not None:
+            result.append((Allow, request.principal.id, ALL_PERMISSIONS))
+        result.append((Allow, Everyone, PUBLIC_PERMISSION))
+        return result
+
 
 @adapter_config(context=Interface, provides=IAdminProfile)
 def AdminProfileFactory(context):

--- a/src/pyams_content/profile/zmi/__init__.py	Mon Jan 18 16:11:40 2016 +0100
+++ b/src/pyams_content/profile/zmi/__init__.py	Mon Jan 18 17:29:16 2016 +0100
@@ -9,7 +9,6 @@
 # WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
 # FOR A PARTICULAR PURPOSE.
 #
-from pyramid.view import view_config
 
 __docformat__ = 'restructuredtext'
 
@@ -25,6 +24,7 @@
 from pyams_security.zmi.profile import UserProfileEditForm
 from pyams_utils.adapter import adapter_config
 from pyams_zmi.form import InnerAdminEditForm
+from pyramid.view import view_config
 from z3c.form import field
 from zope.interface import Interface
 
@@ -40,7 +40,7 @@
     tab_label = _("Admin. profile")
     legend = None
 
-    fields = field.Fields(IAdminProfile)
+    fields = field.Fields(IAdminProfile).omit('favorites')
     edit_permission = None
 
     label_css_class = 'control-label col-md-4'