diff --git a/src/engine/net/client/handlers/ItemProductionMsgHandler.java b/src/engine/net/client/handlers/ItemProductionMsgHandler.java
index de628afe..2489f991 100644
--- a/src/engine/net/client/handlers/ItemProductionMsgHandler.java
+++ b/src/engine/net/client/handlers/ItemProductionMsgHandler.java
@@ -62,6 +62,12 @@ public class ItemProductionMsgHandler extends AbstractClientMsgHandler {
         if (vendor == null)
             return true;
 
+        // Same access rule as opening the vendor's management window (OrderNPCMsgHandler); never trust the client
+
+        if (!BuildingManager.PlayerCanControlNotOwner(vendor.getBuilding(), player)
+                && !BuildingManager.playerCanManage(player, vendor.getBuilding()))
+            return true;
+
         // Process Request
 
         switch (msg.actionType) {