diff --git a/extensions/flags/src/Api/Controller/ListFlagsController.php b/extensions/flags/src/Api/Controller/ListFlagsController.php
index 77296808e..69c4c9f3f 100644
--- a/extensions/flags/src/Api/Controller/ListFlagsController.php
+++ b/extensions/flags/src/Api/Controller/ListFlagsController.php
@@ -14,11 +14,14 @@ namespace Flarum\Flags\Api\Controller;
 use Flarum\Api\Controller\AbstractListController;
 use Flarum\Flags\Api\Serializer\FlagSerializer;
 use Flarum\Flags\Flag;
+use Flarum\User\AssertPermissionTrait;
 use Psr\Http\Message\ServerRequestInterface;
 use Tobscure\JsonApi\Document;
 
 class ListFlagsController extends AbstractListController
 {
+    use AssertPermissionTrait;
+
     /**
      * {@inheritdoc}
      */
@@ -41,6 +44,8 @@ class ListFlagsController extends AbstractListController
     {
         $actor = $request->getAttribute('actor');
 
+        $this->assertRegistered($actor);
+
         $actor->read_flags_at = time();
         $actor->save();