diff --git a/Libraries/Opc.Ua.Server/Diagnostics/MonitoredNode.cs b/Libraries/Opc.Ua.Server/Diagnostics/MonitoredNode.cs
index 640052e78a..53b4511078 100644
--- a/Libraries/Opc.Ua.Server/Diagnostics/MonitoredNode.cs
+++ b/Libraries/Opc.Ua.Server/Diagnostics/MonitoredNode.cs
@@ -294,6 +294,15 @@ namespace Opc.Ua.Server
 
                     if (monitoredItem.AttributeId == Attributes.Value && (changes & NodeStateChangeMasks.Value) != 0)
                     {
+                        // validate if the monitored item has the required role permissions to read the value
+                        ServiceResult validationResult = NodeManager.ValidateRolePermissions(new OperationContext(monitoredItem), node.NodeId, PermissionType.Read);
+
+                        if (ServiceResult.IsBad(validationResult))
+                        {
+                            // skip if the monitored item does not have permission to read
+                            continue;
+                        }
+
                         QueueValue(context, node, monitoredItem);
                         continue;
                     }