diff --git a/application/controllers/HostgroupController.php b/application/controllers/HostgroupController.php
index 3c0faced..98b35205 100644
--- a/application/controllers/HostgroupController.php
+++ b/application/controllers/HostgroupController.php
@@ -19,6 +19,8 @@ class HostgroupController extends Controller
 
     public function init()
     {
+        $this->assertRouteAccess('hostgroups');
+
         $this->setTitle(t('Host Group'));
 
         $name = $this->params->shiftRequired('name');
diff --git a/application/controllers/HostgroupsController.php b/application/controllers/HostgroupsController.php
index e016935c..9e67c265 100644
--- a/application/controllers/HostgroupsController.php
+++ b/application/controllers/HostgroupsController.php
@@ -18,6 +18,13 @@ use ipl\Web\Url;
 
 class HostgroupsController extends Controller
 {
+    public function init()
+    {
+        parent::init();
+
+        $this->assertRouteAccess();
+    }
+
     public function indexAction()
     {
         $this->setTitle(t('Host Groups'));
diff --git a/configuration.php b/configuration.php
index ef7c5306..b6ec9015 100644
--- a/configuration.php
+++ b/configuration.php
@@ -301,10 +301,13 @@ namespace Icinga\Module\Icingadb
         ]);
     }
 
-    $section->add(N_('Host Groups'), [
-        'url' => 'icingadb/hostgroups',
-        'priority' => 80
-    ]);
+    if (! array_key_exists('hostgroups', $routeBlacklist)) {
+        $section->add(N_('Host Groups'), [
+            'url' => 'icingadb/hostgroups',
+            'priority' => 80
+        ]);
+    }
+
     $section->add(N_('Service Groups'), [
         'url' => 'icingadb/servicegroups',
         'priority' => 80
diff --git a/library/Icingadb/Widget/Detail/ObjectDetail.php b/library/Icingadb/Widget/Detail/ObjectDetail.php
index 3f56c11a..1e0914e4 100644
--- a/library/Icingadb/Widget/Detail/ObjectDetail.php
+++ b/library/Icingadb/Widget/Detail/ObjectDetail.php
@@ -191,8 +191,11 @@ class ObjectDetail extends BaseHtmlElement
         $groups = [Html::tag('h2', t('Groups'))];
 
         if ($this->objectType === 'host') {
-            $hostgroups = $this->object->hostgroup;
-            $this->applyRestrictions($hostgroups);
+            $hostgroups = [];
+            if ($this->isPermittedRoute('hostgroups')) {
+                $hostgroups = $this->object->hostgroup;
+                $this->applyRestrictions($hostgroups);
+            }
 
             $hostgroupList = new TagList();
             foreach ($hostgroups as $hostgroup) {