diff --git a/app/controllers/tickets_controller.rb b/app/controllers/tickets_controller.rb
index eb5fd344a..7b380ebab 100644
--- a/app/controllers/tickets_controller.rb
+++ b/app/controllers/tickets_controller.rb
@@ -355,6 +355,9 @@ class TicketsController < ApplicationController
   # GET /api/v1/tickets/search
   def search
 
+    # permit nested conditions
+    params.require(:condition).permit!
+
     # build result list
     tickets = Ticket.search(
       :limit        => params[:limit],