diff --git a/backend/globaleaks/handlers/admin/operation.py b/backend/globaleaks/handlers/admin/operation.py
index 7b9ff8915f..8838ab1443 100644
--- a/backend/globaleaks/handlers/admin/operation.py
+++ b/backend/globaleaks/handlers/admin/operation.py
@@ -278,7 +278,7 @@ def reset_smtp_settings(self, req_args, *args, **kwargs):
         return reset_smtp_settings(self.request.tid)
 
     def disable_2fa(self, req_args, *args, **kwargs):
-        return disable_2fa(self.request.tid, self.request.user_id, req_args['value'])
+        return disable_2fa(self.request.tid, self.session.user_id, req_args['value'])
 
     def set_user_password(self, req_args, *args, **kwargs):
         if self.session.user_id == req_args['user_id']: