diff --git a/lib/Controller/UserApiController.php b/lib/Controller/UserApiController.php
index 948111f6bf2..f960176f4f4 100644
--- a/lib/Controller/UserApiController.php
+++ b/lib/Controller/UserApiController.php
@@ -37,6 +37,7 @@ public function __construct(
 	#[NoAdminRequired]
 	#[RequireDocumentSession]
 	public function index(string $filter = '', int $limit = 5): DataResponse {
+		$limit = min($limit, 50);
 		$sessions = $this->sessionService->getAllSessions($this->getSession()->getDocumentId());
 
 		$users = [];