diff --git a/lib/private/Server.php b/lib/private/Server.php
index be432c0cf2885..c89931a2d1cbb 100644
--- a/lib/private/Server.php
+++ b/lib/private/Server.php
@@ -866,7 +866,7 @@ public function __construct($webRoot, \OC\Config $config) {
 				$classExists = false;
 			}
 
-			if ($classExists && $c->getConfig()->getSystemValue('installed', false) && $c->getAppManager()->isInstalled('theming')) {
+			if ($classExists && $c->getConfig()->getSystemValue('installed', false) && $c->getAppManager()->isInstalled('theming') && $c->getTrustedDomainHelper()->isTrustedDomain($c->getRequest()->getInsecureServerHost())) {
 				return new ThemingDefaults(
 					$c->getConfig(),
 					$c->getL10N('theming'),