diff --git a/src/api/endpoints/users/show.js b/src/api/endpoints/users/show.js
index af475c6cb..43d6e700a 100644
--- a/src/api/endpoints/users/show.js
+++ b/src/api/endpoints/users/show.js
@@ -33,6 +33,11 @@ module.exports = (params, me) =>
 		return rej('user_id or username is required');
 	}
 
+	// Validate id
+	if (userId && !mongo.ObjectID.isValid(userId)) {
+		return rej('incorrect user_id');
+	}
+
 	// Lookup user
 	const user = userId !== null
 		? await User.findOne({ _id: new mongo.ObjectID(userId) })