diff --git a/src/api/server_server.rs b/src/api/server_server.rs
index e4afa2a1..e7d43445 100644
--- a/src/api/server_server.rs
+++ b/src/api/server_server.rs
@@ -924,19 +924,6 @@ pub(crate) async fn create_join_event_template_route(
 	}
 
 	let origin = body.origin.as_ref().expect("server is authenticated");
-
-	// ACL check origin server
-	services()
-		.rooms
-		.event_handler
-		.acl_check(origin, &body.room_id)?;
-
-	// ACL check invited user server name
-	services()
-		.rooms
-		.event_handler
-		.acl_check(body.user_id.server_name(), &body.room_id)?;
-
 	if body.user_id.server_name() != origin {
 		return Err(Error::BadRequest(
 			ErrorKind::InvalidParam,
@@ -944,6 +931,12 @@ pub(crate) async fn create_join_event_template_route(
 		));
 	}
 
+	// ACL check origin server
+	services()
+		.rooms
+		.event_handler
+		.acl_check(origin, &body.room_id)?;
+
 	if services()
 		.globals
 		.config
@@ -1440,20 +1433,6 @@ pub(crate) async fn create_leave_event_template_route(
 	}
 
 	let origin = body.origin.as_ref().expect("server is authenticated");
-
-	// ACL check origin
-	services()
-		.rooms
-		.event_handler
-		.acl_check(origin, &body.room_id)?;
-
-	// ACL check invited user server name
-	services()
-		.rooms
-		.event_handler
-		.acl_check(body.user_id.server_name(), &body.room_id)?;
-
-	// check if origin server is trying to send for another server
 	if body.user_id.server_name() != origin {
 		return Err(Error::BadRequest(
 			ErrorKind::InvalidParam,
@@ -1461,6 +1440,12 @@ pub(crate) async fn create_leave_event_template_route(
 		));
 	}
 
+	// ACL check origin
+	services()
+		.rooms
+		.event_handler
+		.acl_check(origin, &body.room_id)?;
+
 	let room_version_id = services().rooms.state.get_room_version(&body.room_id)?;
 
 	let mutex_state = Arc::clone(