diff --git a/src/pretix/control/middleware.py b/src/pretix/control/middleware.py
index 9a176945d1..9dbff15e3d 100644
--- a/src/pretix/control/middleware.py
+++ b/src/pretix/control/middleware.py
@@ -72,7 +72,7 @@ class PermissionMiddleware:
     )
 
     EXCEPTIONS_FORCED_PW_CHANGE = (
-        "user.settings",
+        "user.settings.password.change",
         "auth.logout"
     )
 
@@ -139,7 +139,7 @@ class PermissionMiddleware:
                 return redirect_to_url(reverse('control:user.reauth') + '?next=' + quote(request.get_full_path()))
         except SessionPasswordChangeRequired:
             if url_name not in self.EXCEPTIONS_FORCED_PW_CHANGE:
-                return redirect_to_url(reverse('control:user.settings') + '?next=' + quote(request.get_full_path()))
+                return redirect_to_url(reverse('control:user.settings.password.change') + '?next=' + quote(request.get_full_path()))
         except Session2FASetupRequired:
             if url_name not in self.EXCEPTIONS_2FA:
                 return redirect_to_url(reverse('control:user.settings.2fa'))
diff --git a/src/pretix/control/views/user.py b/src/pretix/control/views/user.py
index 178ec2b394..d0c5f0cb10 100644
--- a/src/pretix/control/views/user.py
+++ b/src/pretix/control/views/user.py
@@ -847,11 +847,17 @@ class UserPasswordChangeView(FormView):
 
             update_session_auth_hash(self.request, self.request.user)
         return redirect(reverse('control:user.settings', kwargs={}))
+        return redirect(self.get_success_url())
 
     def form_invalid(self, form):
         messages.error(self.request, _('We could not save your changes. See below for details.'))
         return super().form_invalid(form)
 
+    def get_success_url(self):
+        if "next" in self.request.GET and url_has_allowed_host_and_scheme(self.request.GET.get("next"), allowed_hosts=None):
+            return self.request.GET.get("next")
+        return reverse('control:user.settings')
+
 
 class UserEmailChangeView(RecentAuthenticationRequiredMixin, FormView):
     max_time = 300