diff --git a/services/mailer/mail_release.go b/services/mailer/mail_release.go
index 0f2ef33fe1..2111083bd4 100644
--- a/services/mailer/mail_release.go
+++ b/services/mailer/mail_release.go
@@ -6,8 +6,11 @@ package mailer
 import (
 	"bytes"
 	"context"
+	"slices"
 
+	access_model "forgejo.org/models/perm/access"
 	repo_model "forgejo.org/models/repo"
+	"forgejo.org/models/unit"
 	user_model "forgejo.org/models/user"
 	"forgejo.org/modules/base"
 	"forgejo.org/modules/log"
@@ -40,6 +43,12 @@ func MailNewRelease(ctx context.Context, rel *repo_model.Release) {
 		return
 	}
 
+	// Users are not eligible to receive this mail if they are not active or
+	// they don't have permissions to read releases.
+	recipients = slices.DeleteFunc(recipients, func(u *user_model.User) bool {
+		return !u.IsActive || !access_model.CheckRepoUnitUser(ctx, rel.Repo, u, unit.TypeReleases)
+	})
+
 	langMap := make(map[string][]*user_model.User)
 	for _, user := range recipients {
 		if user.ID != rel.PublisherID {