diff --git a/src/api/server/state.rs b/src/api/server/state.rs
index 10796644..c858f6fd 100644
--- a/src/api/server/state.rs
+++ b/src/api/server/state.rs
@@ -6,25 +6,29 @@ use crate::{services, Error, PduEvent, Result, Ruma};
 
 /// # `GET /_matrix/federation/v1/state/{roomId}`
 ///
-/// Retrieves the current state of the room.
+/// Retrieves a snapshot of a room's state at a given event.
 pub(crate) async fn get_room_state_route(
 	body: Ruma<get_room_state::v1::Request>,
 ) -> Result<get_room_state::v1::Response> {
 	let origin = body.origin.as_ref().expect("server is authenticated");
 
-	if !services()
-		.rooms
-		.state_cache
-		.server_in_room(origin, &body.room_id)?
-	{
-		return Err(Error::BadRequest(ErrorKind::forbidden(), "Server is not in room."));
-	}
-
 	services()
 		.rooms
 		.event_handler
 		.acl_check(origin, &body.room_id)?;
 
+	if !services()
+		.rooms
+		.state_accessor
+		.is_world_readable(&body.room_id)?
+		&& !services()
+			.rooms
+			.state_cache
+			.server_in_room(origin, &body.room_id)?
+	{
+		return Err(Error::BadRequest(ErrorKind::forbidden(), "Server is not in room."));
+	}
+
 	let shortstatehash = services()
 		.rooms
 		.state_accessor