diff --git a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java
index bd7814e332..3aed32b4a4 100644
--- a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java
+++ b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java
@@ -1,6 +1,6 @@
 /*
  * DBeaver - Universal Database Manager
- * Copyright (C) 2010-2025 DBeaver Corp and others
+ * Copyright (C) 2010-2026 DBeaver Corp and others
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -405,14 +405,24 @@ public void importUsers(@NotNull SMUserImportList userImportList) throws DBExcep
 
     protected void importUsers(@NotNull Connection connection, @NotNull SMUserImportList userImportList)
         throws DBException, SQLException {
+        List<SMUserProvisioning> users = userImportList.getUsers();
+        Set<String> seen = new HashSet<>();
         outer:
-        for (SMUserProvisioning user : userImportList.getUsers()) {
-            String authRole = user.getAuthRole() == null ? userImportList.getAuthRole() : user.getAuthRole();
-            String userId = user.getUserId();
+        for (SMUserProvisioning user : users) {
             Map<String, String> metaParameters = user.getMetaParameters();
+            String effectiveUserId = user.getUserId();
             if (CommonUtils.isNotEmpty(metaParameters.get(SMStandardMeta.META_USER_ID))) {
-                userId = metaParameters.get(SMStandardMeta.META_USER_ID);
+                effectiveUserId = metaParameters.get(SMStandardMeta.META_USER_ID);
+            }
+            String effectiveUserIdLowerCase = effectiveUserId.toLowerCase();
+            if (seen.contains(effectiveUserIdLowerCase)) {
+                log.warn("Skipping duplicate user (case-insensitive): " + effectiveUserId);
+                continue;
             }
+            seen.add(effectiveUserIdLowerCase);
+
+            String authRole = user.getAuthRole() == null ? userImportList.getAuthRole() : user.getAuthRole();
+            String userId = effectiveUserId;
             for (String possibleUserId : List.of(userId, userId.toLowerCase())) {
                 if (isSubjectExists(possibleUserId)) {
                     if (getSubjectType(possibleUserId) == SMSubjectType.team) {