diff --git a/server/controllers/auth.go b/server/controllers/auth.go
index 36902e5e..ae0225a1 100644
--- a/server/controllers/auth.go
+++ b/server/controllers/auth.go
@@ -62,6 +62,7 @@ func Login(c *gin.Context) {
 // if token is empty, return guest user
 func CurrentUser(c *gin.Context) {
 	user := c.MustGet("user").(*model.User)
-	user.Password = ""
-	common.SuccessResp(c, user)
+	userResp := *user
+	userResp.Password = ""
+	common.SuccessResp(c, userResp)
 }