diff --git a/api/http/handler/templates/handler.go b/api/http/handler/templates/handler.go
index 5c89f350f..0bcb411f7 100644
--- a/api/http/handler/templates/handler.go
+++ b/api/http/handler/templates/handler.go
@@ -24,8 +24,8 @@ func NewHandler(bouncer *security.RequestBouncer) *Handler {
 	}
 
 	h.Handle("/templates",
-		bouncer.RestrictedAccess(httperror.LoggerHandler(h.templateList))).Methods(http.MethodGet)
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.templateList))).Methods(http.MethodGet)
 	h.Handle("/templates/file",
-		bouncer.RestrictedAccess(httperror.LoggerHandler(h.templateFile))).Methods(http.MethodPost)
+		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.templateFile))).Methods(http.MethodPost)
 	return h
 }
diff --git a/api/http/security/rbac.go b/api/http/security/rbac.go
index c6c4211af..bdc17ca39 100644
--- a/api/http/security/rbac.go
+++ b/api/http/security/rbac.go
@@ -542,6 +542,9 @@ func portainerTemplatesOperationAuthorization(url, method string) portainer.Auth
 		if resource == "" && action == "" {
 			return portainer.OperationPortainerTemplateCreate
 		}
+		if resource == "file" && action == "" {
+			return portainer.OperationPortainerTemplateInspect
+		}
 	case http.MethodPut:
 		if resource != "" && action == "" {
 			return portainer.OperationPortainerTemplateUpdate
diff --git a/app/docker/components/dockerSidebarContent/dockerSidebarContent.html b/app/docker/components/dockerSidebarContent/dockerSidebarContent.html
index 5af425761..f97ff4491 100644
--- a/app/docker/components/dockerSidebarContent/dockerSidebarContent.html
+++ b/app/docker/components/dockerSidebarContent/dockerSidebarContent.html
@@ -1,7 +1,7 @@
 <li class="sidebar-list">
   <a ui-sref="docker.dashboard({endpointId: $ctrl.endpointId})" ui-sref-active="active">Dashboard <span class="menu-icon fa fa-tachometer-alt fa-fw"></span></a>
 </li>
-<li class="sidebar-list" ng-if="!$ctrl.offlineMode" authorization="DockerContainerCreate, PortainerStackCreate">
+<li class="sidebar-list" ng-if="!$ctrl.offlineMode">
   <a ui-sref="docker.templates({endpointId: $ctrl.endpointId})" ui-sref-active="active">App Templates <span class="menu-icon fa fa-rocket fa-fw"></span></a>
 
   <div class="sidebar-sublist" ng-if="$ctrl.toggle && $ctrl.currentRouteName.includes('docker.templates')">
diff --git a/app/portainer/views/custom-templates/custom-templates-view/customTemplatesViewController.js b/app/portainer/views/custom-templates/custom-templates-view/customTemplatesViewController.js
index ff456add3..b517a69b6 100644
--- a/app/portainer/views/custom-templates/custom-templates-view/customTemplatesViewController.js
+++ b/app/portainer/views/custom-templates/custom-templates-view/customTemplatesViewController.js
@@ -168,6 +168,10 @@ class CustomTemplatesViewController {
     return this.$async(this.selectTemplateAsync, template);
   }
   async selectTemplateAsync(template) {
+    if (!this.Authentication.isAdmin() && !this.Authentication.hasAuthorizations(['DockerContainerCreate', 'PortainerStackCreate'])) {
+      return;
+    }
+
     if (this.state.selectedTemplate) {
       await this.unselectTemplate(this.state.selectedTemplate);
     }
diff --git a/app/portainer/views/templates/templatesController.js b/app/portainer/views/templates/templatesController.js
index 04f9d224a..19fbcaee3 100644
--- a/app/portainer/views/templates/templatesController.js
+++ b/app/portainer/views/templates/templatesController.js
@@ -223,6 +223,10 @@ angular.module('portainer.app').controller('TemplatesController', [
     };
 
     $scope.selectTemplate = function (template) {
+      if (!Authentication.isAdmin() && !Authentication.hasAuthorizations(['DockerContainerCreate', 'PortainerStackCreate'])) {
+        return;
+      }
+
       if ($scope.state.selectedTemplate) {
         $scope.unselectTemplate($scope.state.selectedTemplate);
       }