diff --git a/src/api/server_server.rs b/src/api/server_server.rs
index 47b8f4de..07a848bb 100644
--- a/src/api/server_server.rs
+++ b/src/api/server_server.rs
@@ -880,7 +880,20 @@ pub(crate) async fn create_join_event_template_route(
 	services()
 		.rooms
 		.event_handler
-		.acl_check(sender_servername, &body.room_id)?;
+		.acl_check(origin, &body.room_id)?;
+
+	// ACL check invited user server name
+	services()
+		.rooms
+		.event_handler
+		.acl_check(body.user_id.server_name(), &body.room_id)?;
+
+	if body.user_id.server_name() != origin {
+		return Err(Error::BadRequest(
+			ErrorKind::InvalidParam,
+			"Not allowed to join on behalf of another server/user",
+		));
+	}
 
 	if services()
 		.globals