diff --git a/bookwyrm/settings.py b/bookwyrm/settings.py
index 1f9cd87ed..e6435c545 100644
--- a/bookwyrm/settings.py
+++ b/bookwyrm/settings.py
@@ -11,7 +11,7 @@ from django.utils.translation import gettext_lazy as _
 env = Env()
 env.read_env()
 DOMAIN = env("DOMAIN")
-VERSION = "0.4.6"
+VERSION = "0.5.0"
 
 RELEASE_API = env(
     "RELEASE_API",
diff --git a/bookwyrm/views/admin/invite.py b/bookwyrm/views/admin/invite.py
index 5c9b61fde..9256094aa 100644
--- a/bookwyrm/views/admin/invite.py
+++ b/bookwyrm/views/admin/invite.py
@@ -85,6 +85,11 @@ class Invite(View):
     # post handling is in views.register.Register
 
 
+@method_decorator(login_required, name="dispatch")
+@method_decorator(
+    permission_required("bookwyrm.create_invites", raise_exception=True),
+    name="dispatch",
+)
 class ManageInviteRequests(View):
     """grant invites like the benevolent lord you are"""
 
@@ -177,6 +182,7 @@ class InviteRequest(View):
 
 
 @require_POST
+@permission_required("bookwyrm.create_invites", raise_exception=True)
 def ignore_invite_request(request):
     """hide an invite request"""
     invite_request = get_object_or_404(