diff --git a/controllers/ViewPhotoAlbum.php b/controllers/ViewPhotoAlbum.php
index 6524c86..b494f7a 100644
--- a/controllers/ViewPhotoAlbum.php
+++ b/controllers/ViewPhotoAlbum.php
@@ -59,7 +59,6 @@ class ViewPhotoAlbum extends HTMLController
 			$this->page->adopt($header_box);
 
 		// Can we do fancy things here?
-		// !!! TODO: permission system?
 		$buttons = $this->getAlbumButtons($id_tag, $tag ?? null);
 		if (!empty($buttons))
 			$this->page->adopt(new AlbumButtonBox($buttons));
@@ -78,8 +77,12 @@ class ViewPhotoAlbum extends HTMLController
 		{
 			$index = new PhotosIndex($mosaic, Registry::get('user')->isAdmin());
 			$this->page->adopt($index);
-			if ($id_tag > 1)
-				$index->setUrlSuffix('?in=' . $id_tag);
+
+			$url_suffix = $id_tag > 1 ? 'in=' . $id_tag : '';
+			$index->setUrlSuffix('?' . $url_suffix);
+
+			$menu_items = $this->getEditMenuItems('&' . $url_suffix);
+			$index->setEditMenuItems($menu_items);
 		}
 
 		// Make a page index as needed, while we're at it.
@@ -198,6 +201,46 @@ class ViewPhotoAlbum extends HTMLController
 		return $buttons;
 	}
 
+	private function getEditMenuItems($url_suffix)
+	{
+		$items = [];
+		$sess = '&' . Session::getSessionTokenKey() . '=' . Session::getSessionToken();
+
+		if (Registry::get('user')->isLoggedIn())
+		{
+			$items[] = [
+				'label' => 'Edit image',
+				'uri' => fn($image) => $image->getEditUrl() . $url_suffix,
+			];
+
+			$items[] = [
+				'label' => 'Delete image',
+				'uri' => fn($image) => $image->getDeleteUrl() . $url_suffix . $sess,
+				'onclick' => 'return confirm(\'Are you sure you want to delete this image?\');',
+			];
+		}
+
+		if (Registry::get('user')->isAdmin())
+		{
+			$items[] = [
+				'label' => 'Make album cover',
+				'uri' => fn($image) => $image->getEditUrl() . $url_suffix . '&album_cover' . $sess,
+			];
+
+			$items[] = [
+				'label' => 'Increase priority',
+				'uri' => fn($image) => $image->getEditUrl() . $url_suffix . '&inc_prio' . $sess,
+			];
+
+			$items[] = [
+				'label' => 'Decrease priority',
+				'uri' => fn($image) => $image->getEditUrl() . $url_suffix . '&dec_prio' . $sess,
+			];
+		}
+
+		return $items;
+	}
+
 	public function __destruct()
 	{
 		if (isset($this->iterator))
diff --git a/models/Asset.php b/models/Asset.php
index 85b8de9..0205b54 100644
--- a/models/Asset.php
+++ b/models/Asset.php
@@ -36,6 +36,11 @@ class Asset
 			$this->date_captured = new DateTime($data['date_captured']);
 	}
 
+	public function canBeEditedBy(User $user)
+	{
+		return $this->isOwnedBy($user) || $user->isAdmin();
+	}
+
 	public static function cleanSlug($slug)
 	{
 		// Only alphanumerical chars, underscores and forward slashes are allowed
diff --git a/templates/PhotosIndex.php b/templates/PhotosIndex.php
index a104bca..37a2efc 100644
--- a/templates/PhotosIndex.php
+++ b/templates/PhotosIndex.php
@@ -14,7 +14,7 @@ class PhotosIndex extends Template
 	protected $show_labels;
 	protected $previous_header = '';
 
-	protected $edit_url_suffix;
+	protected $edit_menu_items = [];
 	protected $photo_url_suffix;
 
 	const PANORAMA_WIDTH = 1256;
@@ -85,27 +85,24 @@ class PhotosIndex extends Template
 
 	protected function editMenu(Image $image)
 	{
-		$edit_url = $image->getEditUrl() . $this->edit_url_suffix;
+		if (empty($this->edit_menu_items))
+			return;
 
 		echo '
 				<div class="edit dropdown">
 					<button class="btn btn-primary btn-sm dropdown-toggle" type="button" data-bs-toggle="dropdown" aria-expanded="false">
 					</button>
-					<ul class="dropdown-menu">
-						<li><a class="dropdown-item" href="', $edit_url, '">Edit image</a></li>
-						<li><a class="dropdown-item" href="', $image->getDeleteUrl(), '&',
-							Session::getSessionTokenKey(), '=', Session::getSessionToken(),
-							'" onclick="return confirm(\'Are you sure you want to delete this image?\');',
-							'">Delete image</a></li>
-						<li><a class="dropdown-item" href="', $edit_url, '&album_cover&',
-							Session::getSessionTokenKey(), '=', Session::getSessionToken(),
-							'">Make album cover</a></li>
-						<li><a class="dropdown-item" href="', $edit_url, '&inc_prio&',
-							Session::getSessionTokenKey(), '=', Session::getSessionToken(),
-							'">Increase priority</a></li>
-						<li><a class="dropdown-item" href="', $edit_url, '&dec_prio&',
-							Session::getSessionTokenKey(), '=', Session::getSessionToken(),
-							'">Decrease priority</a></li>
+					<ul class="dropdown-menu">';
+
+		foreach ($this->edit_menu_items as $item)
+		{
+			echo '
+						<li><a class="dropdown-item" href="', $item['uri']($image), '"',
+							isset($item['onclick']) ? ' onclick="' . $item['onclick'] . '"' : '',
+							'>', $item['label'], '</a></li>';
+		}
+
+		echo '
 					</ul>
 				</div>';
 	}
@@ -118,7 +115,7 @@ class PhotosIndex extends Template
 		echo '
 				<div class="polaroid ', $className, '" style="aspect-ratio: ', $aspectRatio, '">';
 
-		if ($this->show_edit_buttons)
+		if ($this->show_edit_buttons && $image->canBeEditedBy(Registry::get('user')))
 			$this->editMenu($image);
 
 		echo '
@@ -347,9 +344,13 @@ class PhotosIndex extends Template
 		$this->threePortraits($photos, $altLayout);
 	}
 
+	public function setEditMenuItems(array $items)
+	{
+		$this->edit_menu_items = $items;
+	}
+
 	public function setUrlSuffix($suffix)
 	{
 		$this->photo_url_suffix = $suffix;
-		$this->edit_url_suffix = str_replace('?', '&', $suffix);
 	}
 }