diff --git a/erpnext/projects/doctype/project/project.py b/erpnext/projects/doctype/project/project.py
index ab2dc14b518..53bb7b56036 100644
--- a/erpnext/projects/doctype/project/project.py
+++ b/erpnext/projects/doctype/project/project.py
@@ -667,6 +667,10 @@ def create_duplicate_project(prev_doc: str | dict, project_name: str):
 
 	prev_doc = frappe.parse_json(prev_doc)
 
+	# prev_doc is caller-supplied, but the tasks below are read from the db by name
+	if source_name := prev_doc.get("name"):
+		frappe.has_permission("Project", "read", source_name, throw=True)
+
 	if project_name == prev_doc.get("name"):
 		frappe.throw(_("Use a name that is different from previous project name"))