diff --git a/src/service/rooms/timeline/create.rs b/src/service/rooms/timeline/create.rs
index 40e41b084..b884bc970 100644
--- a/src/service/rooms/timeline/create.rs
+++ b/src/service/rooms/timeline/create.rs
@@ -81,6 +81,11 @@ fn from_evt(
 			))
 		}
 	}
+
+	if !self.services.globals.user_is_local(sender) {
+		return Err!(Request(Forbidden("Sender must be a local user")));
+	}
+
 	let PduBuilder {
 		event_type,
 		content,