diff --git a/src/Appwrite/Platform/Modules/Notifications/Http/Notifications/XList.php b/src/Appwrite/Platform/Modules/Notifications/Http/Notifications/XList.php
index 461a210016..7916ce29ff 100644
--- a/src/Appwrite/Platform/Modules/Notifications/Http/Notifications/XList.php
+++ b/src/Appwrite/Platform/Modules/Notifications/Http/Notifications/XList.php
@@ -97,6 +97,9 @@ class XList extends Action
             $cursor->setValue($cursorDocument);
         }
 
+        $queries[] = Query::equal('resourceType', [RESOURCE_TYPE_USERS]);
+        $queries[] = Query::equal('resourceId', [$user->getId()]);
+
         $filterQueries = Query::groupByType($queries)['filters'];
 
         try {
diff --git a/tests/unit/Platform/Modules/Notifications/NotificationsTest.php b/tests/unit/Platform/Modules/Notifications/NotificationsTest.php
new file mode 100644
index 0000000000..d5126a68a5
--- /dev/null
+++ b/tests/unit/Platform/Modules/Notifications/NotificationsTest.php
@@ -0,0 +1,127 @@
+<?php
+
+namespace Tests\Unit\Platform\Modules\Notifications;
+
+use Appwrite\Platform\Modules\Notifications\Http\Notifications\XList;
+use Appwrite\Utopia\Response;
+use PHPUnit\Framework\TestCase;
+use Utopia\Cache\Adapter\None as NoCache;
+use Utopia\Cache\Cache;
+use Utopia\Database\Adapter\Memory;
+use Utopia\Database\Database;
+use Utopia\Database\Document;
+use Utopia\Database\Helpers\Permission;
+use Utopia\Database\Helpers\Role;
+use Utopia\Database\Validator\Authorization;
+
+require_once __DIR__ . '/../../../../../app/init.php';
+
+class CapturingNotificationsResponse extends Response
+{
+    public Document $document;
+    public string $model = '';
+
+    public function __construct()
+    {
+    }
+
+    public function dynamic(Document $document, string $model): void
+    {
+        $this->document = $document;
+        $this->model = $model;
+    }
+}
+
+class NotificationsTest extends TestCase
+{
+    private Authorization $authorization;
+    private Database $database;
+
+    protected function setUp(): void
+    {
+        $this->authorization = new Authorization();
+        $this->authorization->addRole(Role::any()->toString());
+
+        $this->database = new Database(new Memory(), new Cache(new NoCache()));
+        $this->database
+            ->setAuthorization($this->authorization)
+            ->setDatabase('notificationEndpointTests')
+            ->setNamespace('notifications_' . \uniqid());
+
+        $permissions = [
+            Permission::create(Role::any()),
+            Permission::read(Role::any()),
+            Permission::update(Role::any()),
+            Permission::delete(Role::any()),
+        ];
+
+        $this->database->create();
+        $this->database->createCollection('alerts', [], [], $permissions, false);
+        $this->database->createAttribute('alerts', 'messageId', Database::VAR_STRING, 255, false);
+        $this->database->createAttribute('alerts', 'recipientHash', Database::VAR_STRING, 64, true);
+        $this->database->createAttribute('alerts', 'type', Database::VAR_STRING, 64, false, 'info');
+        $this->database->createAttribute('alerts', 'channel', Database::VAR_STRING, 64, true);
+        $this->database->createAttribute('alerts', 'projectId', Database::VAR_STRING, 255, true);
+        $this->database->createAttribute('alerts', 'projectInternalId', Database::VAR_ID, 0, true);
+        $this->database->createAttribute('alerts', 'resourceType', Database::VAR_STRING, 64, true);
+        $this->database->createAttribute('alerts', 'resourceId', Database::VAR_STRING, 255, true);
+        $this->database->createAttribute('alerts', 'resourceInternalId', Database::VAR_ID, 0, true);
+        $this->database->createAttribute('alerts', 'parentResourceType', Database::VAR_STRING, 64, true);
+        $this->database->createAttribute('alerts', 'parentResourceId', Database::VAR_STRING, 255, true);
+        $this->database->createAttribute('alerts', 'parentResourceInternalId', Database::VAR_ID, 0, true);
+        $this->database->createAttribute('alerts', 'title', Database::VAR_STRING, 256, true);
+        $this->database->createAttribute('alerts', 'body', Database::VAR_STRING, 16384, true);
+        $this->database->createAttribute('alerts', 'read', Database::VAR_BOOLEAN, 0, false, false);
+    }
+
+    protected function tearDown(): void
+    {
+        $this->authorization->cleanRoles();
+        $this->authorization->addRole(Role::any()->toString());
+    }
+
+    public function testListReturnsOnlyCurrentUserNotifications(): void
+    {
+        $this->createNotification('user-alert', RESOURCE_TYPE_USERS, 'user-a');
+        $this->createNotification('team-alert', RESOURCE_TYPE_TEAMS, 'team-a');
+
+        $response = new CapturingNotificationsResponse();
+
+        (new XList())->action(
+            [],
+            $response,
+            $this->database,
+            new Document(['$id' => 'console']),
+            new Document(['$id' => 'user-a']),
+        );
+
+        $notifications = $response->document->getAttribute('notifications');
+
+        $this->assertCount(1, $notifications);
+        $this->assertSame('user-alert', $notifications[0]->getId());
+        $this->assertSame(1, $response->document->getAttribute('total'));
+        $this->assertSame(Response::MODEL_NOTIFICATION_LIST, $response->model);
+    }
+
+    private function createNotification(string $id, string $resourceType, string $resourceId): Document
+    {
+        return $this->database->createDocument('alerts', new Document([
+            '$id' => $id,
+            'messageId' => $id,
+            'recipientHash' => \substr(\md5($id), 0, 16),
+            'type' => 'info',
+            'channel' => NOTIFICATION_TYPE_CONSOLE,
+            'projectId' => 'project',
+            'projectInternalId' => '10',
+            'resourceType' => $resourceType,
+            'resourceId' => $resourceId,
+            'resourceInternalId' => '20',
+            'parentResourceType' => RESOURCE_TYPE_PROJECTS,
+            'parentResourceId' => 'project',
+            'parentResourceInternalId' => '10',
+            'title' => 'Title',
+            'body' => 'Body',
+            'read' => false,
+        ]));
+    }
+}