diff --git a/packages/plugins/users-permissions/server/controllers/validation/email-template.js b/packages/plugins/users-permissions/server/controllers/validation/email-template.js
index ce455b59b8..58fe0d7d86 100644
--- a/packages/plugins/users-permissions/server/controllers/validation/email-template.js
+++ b/packages/plugins/users-permissions/server/controllers/validation/email-template.js
@@ -3,7 +3,15 @@
 const _ = require('lodash');
 
 const invalidPatternsRegexes = [/<%[^=]([^<>%]*)%>/m, /\${([^{}]*)}/m];
-const authorizedKeys = ['URL', 'CODE', 'USER', 'USER.email', 'USER.username', 'TOKEN'];
+const authorizedKeys = [
+  'URL',
+  'SERVER_URL',
+  'CODE',
+  'USER',
+  'USER.email',
+  'USER.username',
+  'TOKEN',
+];
 
 const matchAll = (pattern, src) => {
   const matches = [];