diff --git a/src/web/api/music.ts b/src/web/api/music.ts
index 1e8a1a5..3a0f682 100644
--- a/src/web/api/music.ts
+++ b/src/web/api/music.ts
@@ -3,6 +3,7 @@ import type { MusicProvider } from "../../music/provider.js";
 import { YouTubeProvider } from "../../music/youtube.js";
 import type { Logger } from "../../logger.js";
 import { requirePermission } from "../middleware/requirePermission.js";
+import { requireNotGuest } from "../middleware/requireNotGuest.js";
 
 export function createMusicRouter(
   neteaseProvider: MusicProvider,
@@ -209,7 +210,7 @@ export function createMusicRouter(
   });
 
   // Get current quality
-  router.get("/quality", (_req, res) => {
+  router.get("/quality", requireNotGuest, (_req, res) => {
     res.json({
       netease: neteaseProvider.getQuality(),
       qq: qqProvider.getQuality(),
diff --git a/src/web/api/permissions-enforcement.test.ts b/src/web/api/permissions-enforcement.test.ts
index bd2104a..4593393 100644
--- a/src/web/api/permissions-enforcement.test.ts
+++ b/src/web/api/permissions-enforcement.test.ts
@@ -188,6 +188,13 @@ describe("permission enforcement on action routes", () => {
       const res = await request(app).post("/api/music/quality").send({ quality: "high" });
       expect(res.status).not.toBe(403);
     });
+
+    it("GET /api/music/quality is 403 for guests, allowed for members", async () => {
+      const guestApp = makeApp(guest());
+      expect((await request(guestApp).get("/api/music/quality")).status).toBe(403);
+      const memberApp = makeApp(member([], "all"));
+      expect((await request(memberApp).get("/api/music/quality")).status).toBe(200);
+    });
   });
 
   describe("read-only routes stay open", () => {