diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php
index f236266d81..2afcd77a6f 100644
--- a/app/controllers/shared/api.php
+++ b/app/controllers/shared/api.php
@@ -313,7 +313,8 @@ Http::init()
                         true => substr($adminRole, strrpos($adminRole, '-') + 1),
                         false => $adminRole,
                     };
-                    $scopes = \array_merge($scopes, $roles[$role]['scopes']);
+                    $roleScopes = $roles[$role]['scopes'] ?? [];
+                    $scopes = \array_merge($scopes, $roleScopes);
                     $authorization->addRole($role);
                 }
             }