diff --git a/packages/strapi-plugin-users-permissions/controllers/User.js b/packages/strapi-plugin-users-permissions/controllers/User.js
index 745bd6ceaf..12055f0120 100644
--- a/packages/strapi-plugin-users-permissions/controllers/User.js
+++ b/packages/strapi-plugin-users-permissions/controllers/User.js
@@ -130,7 +130,7 @@ module.exports = {
           email: ctx.request.body.email
         });
 
-        if ((user.id || user._id).toString() !== ctx.params.id) {
+        if (user !== null && (user.id || user._id).toString() !== ctx.params.id) {
           return ctx.badRequest(null, ctx.request.admin ? [{ messages: [{ id: 'Auth.form.error.email.taken' }] }] : 'Email is already taken.');
         }
       }