diff --git a/apps/files_external/js/settings.js b/apps/files_external/js/settings.js
index 582276cad0940..5cbd011bcc1ba 100644
--- a/apps/files_external/js/settings.js
+++ b/apps/files_external/js/settings.js
@@ -267,7 +267,6 @@ StorageConfig.prototype = {
 	 * @param {Function} [options.error] error callback
 	 */
 	save: function(options) {
-		var self = this;
 		var url = OC.generateUrl(this._url);
 		var method = 'POST';
 		if (_.isNumber(this.id)) {
@@ -275,6 +274,18 @@ StorageConfig.prototype = {
 			url = OC.generateUrl(this._url + '/{id}', {id: this.id});
 		}
 
+		window.OC.PasswordConfirmation.requirePasswordConfirmation(() => this._save(method, url, options), options.error);
+	},
+
+	/**
+	 * Private implementation of the save function (called after potential password confirmation)
+	 * @param {string} method 
+	 * @param {string} url 
+	 * @param {{success: Function, error: Function}} options 
+	 */
+	_save: function(method, url, options) {
+		self = this;
+
 		$.ajax({
 			type: method,
 			url: url,
@@ -348,6 +359,15 @@ StorageConfig.prototype = {
 			}
 			return;
 		}
+
+		window.OC.PasswordConfirmation.requirePasswordConfirmation(() => this._destroy(options), options.error)
+	},
+
+	/**
+	 * Private implementation of the DELETE method called after password confirmation
+	 * @param {{ success: Function, error: Function }} options 
+	 */
+	_destroy: function(options) {
 		$.ajax({
 			type: 'DELETE',
 			url: OC.generateUrl(this._url + '/{id}', {id: this.id}),
diff --git a/apps/files_external/lib/Controller/UserStoragesController.php b/apps/files_external/lib/Controller/UserStoragesController.php
index ac806fe219c8c..0cd060b52948b 100644
--- a/apps/files_external/lib/Controller/UserStoragesController.php
+++ b/apps/files_external/lib/Controller/UserStoragesController.php
@@ -13,6 +13,7 @@
 use OCA\Files_External\Service\UserStoragesService;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\IConfig;
 use OCP\IGroupManager;
@@ -99,6 +100,7 @@ public function show($id, $testOnly = true) {
 	 * @return DataResponse
 	 */
 	#[NoAdminRequired]
+	#[PasswordConfirmationRequired]
 	public function create(
 		$mountPoint,
 		$backend,
@@ -154,6 +156,7 @@ public function create(
 	 * @return DataResponse
 	 */
 	#[NoAdminRequired]
+	#[PasswordConfirmationRequired]
 	public function update(
 		$id,
 		$mountPoint,
@@ -205,6 +208,7 @@ public function update(
 	 * {@inheritdoc}
 	 */
 	#[NoAdminRequired]
+	#[PasswordConfirmationRequired]
 	public function destroy($id) {
 		return parent::destroy($id);
 	}