diff --git a/apiserver/apiserver/api/views.py b/apiserver/apiserver/api/views.py
index 509a8a7..10f6ce8 100644
--- a/apiserver/apiserver/api/views.py
+++ b/apiserver/apiserver/api/views.py
@@ -1790,7 +1790,7 @@ class HostingViewSet(Base):
 
 
 class StorageSpaceViewSet(Base, List, Retrieve, Update):
-    permission_classes = [AllowMetadata | IsAdmin]
+    permission_classes = [AllowMetadata | IsAuthenticated, IsAdminOrReadOnly]
     queryset = models.StorageSpace.objects.all().order_by('id')
     serializer_class = serializers.StorageSpaceSerializer