diff --git a/go.mod b/go.mod
index 7831da7..4305efc 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module gitea.tecamino.com/paadi/access-handler
 go 1.24.5
 
 require (
-	gitea.tecamino.com/paadi/dbHandler v1.1.10
+	gitea.tecamino.com/paadi/dbHandler v1.1.12
 	gitea.tecamino.com/paadi/tecamino-logger v0.2.1
 	github.com/gin-gonic/gin v1.11.0
 	github.com/go-playground/assert/v2 v2.2.0
diff --git a/go.sum b/go.sum
index 320708f..9c16b46 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-gitea.tecamino.com/paadi/dbHandler v1.1.10 h1:zZQbDTJ0bu6CIW90Zms8yYIzTLHtWPNhVKRxLUXEDuE=
-gitea.tecamino.com/paadi/dbHandler v1.1.10/go.mod h1:y/xn/POJg1DO++67uKvnO23lJQgh+XFQq7HZCS9Getw=
+gitea.tecamino.com/paadi/dbHandler v1.1.12 h1:F1ARSTUm0MZmF84FfD/g5RQNMYyDYXHYrB3cXPSi4qw=
+gitea.tecamino.com/paadi/dbHandler v1.1.12/go.mod h1:y/xn/POJg1DO++67uKvnO23lJQgh+XFQq7HZCS9Getw=
 gitea.tecamino.com/paadi/tecamino-logger v0.2.1 h1:sQTBKYPdzn9mmWX2JXZBtGBvNQH7cuXIwsl4TD0aMgE=
 gitea.tecamino.com/paadi/tecamino-logger v0.2.1/go.mod h1:FkzRTldUBBOd/iy2upycArDftSZ5trbsX5Ira5OzJgM=
 github.com/bytedance/sonic v1.14.0 h1:/OfKt8HFw0kh2rj8N0F6C/qPGRESq0BbaNZgcNXXzQQ=
diff --git a/handlers/user.go b/handlers/user.go
index f838ee2..2274e88 100644
--- a/handlers/user.go
+++ b/handlers/user.go
@@ -45,6 +45,7 @@ func (aH *AccessHandler) AddDefaultUser() (err error) {
 	if err := aH.dbHandler.GetByKey(role, "role", "admin", false); err != nil {
 		return err
 	}
+
 	return aH.dbHandler.AddRelation(user, role, "Role")
 }
 
@@ -132,7 +133,7 @@ func (aH *AccessHandler) ChangePassword(c *gin.Context) {
 
 	// get user to check ChangePassword
 	var dbRecord models.User
-	err = aH.dbHandler.GetById(&dbRecord, user.Id, "Role")
+	err = aH.dbHandler.GetById(&dbRecord, user.Id, "Role", "Workspaces")
 	if err != nil {
 		aH.logger.Error("ChangePassword", err)
 		c.JSON(http.StatusInternalServerError, nil)
@@ -158,7 +159,7 @@ func (aH *AccessHandler) ChangePassword(c *gin.Context) {
 	aH.logger.Debug("ChangePassword", "change user "+user.Name+" password")
 
 	// Update user
-	aH.dbHandler.UpdateValuesById(&user, user.Id, "Role")
+	aH.dbHandler.UpdateValuesById(&user, user.Id, "Role", "Workspaces")
 
 	c.JSON(http.StatusOK, gin.H{
 		"message": fmt.Sprintf("password of user '%s' changed", user.Name),
@@ -182,12 +183,18 @@ func (aH *AccessHandler) GetUser(c *gin.Context) {
 	}
 
 	var users []models.User
-	err = aH.dbHandler.GetById(&users, uint(i), "Role")
+	err = aH.dbHandler.GetById(&users, uint(i), "Role", "Workspaces")
 	if err != nil {
 		aH.logger.Error("GetUser", err)
 		c.JSON(http.StatusInternalServerError, nil)
 		return
 	}
+
+	//remove password
+	for i := range users {
+		users[i].Password = ""
+	}
+
 	c.JSON(http.StatusOK, users)
 }
 
@@ -198,14 +205,27 @@ func (aH *AccessHandler) UpdateUser(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, nil)
 		return
 	}
-	err := aH.dbHandler.UpdateValuesById(&user, user.Id, "Role")
+
+	var currentUser models.User
+	err := aH.dbHandler.GetById(&currentUser, user.Id, "Role", "Workspace")
 	if err != nil {
 		aH.logger.Error("UpdateUser", err)
 		c.JSON(http.StatusInternalServerError, nil)
 		return
 	}
-	if len(user.Workspaces) > 0 {
-		aH.dbHandler.AddRelation(&user, user.Workspaces, "Workspaces")
+
+	err = aH.dbHandler.ReplaceRelation(&user, "Workspaces", user.Workspaces)
+	if err != nil {
+		aH.logger.Error("UpdateUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	err = aH.dbHandler.UpdateValuesById(&user, user.Id, "Role", "Workspaces")
+	if err != nil {
+		aH.logger.Error("UpdateUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
 	}
 
 	c.JSON(http.StatusOK, models.NewJsonMessageResponse("successfully updated user '"+user.Email+"'"))
diff --git a/models/user.go b/models/user.go
index 069e33a..7fdf3bb 100644
--- a/models/user.go
+++ b/models/user.go
@@ -10,7 +10,7 @@ type User struct {
 	Email       string       `gorm:"column:email" json:"email"`
 	RoleID      *uint        `gorm:"column:roleId" json:"roleId,omitempty"`
 	Role        *Role        `gorm:"foreignKey:RoleID" json:"role,omitempty"`
-	Password    string       `gorm:"column:password" json:"password"`
+	Password    string       `gorm:"column:password" json:"password,omitempty"`
 	NewPassword string       `gorm:"-" json:"newPassword,omitempty"`
 	Expiration  string       `gorm:"column:expiration" json:"expiration,omitempty"`
 	Settings    Settings     `gorm:"type:json" json:"settings"`