diff --git a/erpnext/projects/doctype/project/project.py b/erpnext/projects/doctype/project/project.py
index 80ef45c099d..0e9e9d11dae 100644
--- a/erpnext/projects/doctype/project/project.py
+++ b/erpnext/projects/doctype/project/project.py
@@ -590,12 +590,16 @@ def allow_to_make_project_update(project, time, frequency):
 
 
 @frappe.whitelist()
-def create_duplicate_project(prev_doc, project_name):
+def create_duplicate_project(prev_doc: str | dict, project_name: str):
 	"""Create duplicate project based on the old project"""
 	import json
 
 	prev_doc = json.loads(prev_doc)
 
+	# prev_doc is caller-supplied, but the tasks below are read from the db by name
+	if source_name := prev_doc.get("name"):
+		frappe.has_permission("Project", "read", source_name, throw=True)
+
 	if project_name == prev_doc.get("name"):
 		frappe.throw(_("Use a name that is different from previous project name"))