diff --git a/modules/monitoring/application/controllers/ListController.php b/modules/monitoring/application/controllers/ListController.php
index f5afc9a24..3ed9c4e62 100644
--- a/modules/monitoring/application/controllers/ListController.php
+++ b/modules/monitoring/application/controllers/ListController.php
@@ -306,7 +306,10 @@ class Monitoring_ListController extends Controller
         ));
 
         $this->view->downtimes = $query->paginate();
-        $this->view->delDowntimeForm = new DeleteDowntimeCommandForm();
+
+        if ($this->Auth()->hasPermission('monitoring/command/downtime/delete')) {
+            $this->view->delDowntimeForm = new DeleteDowntimeCommandForm();
+        }
     }
 
     /**
diff --git a/modules/monitoring/application/views/scripts/list/downtimes.phtml b/modules/monitoring/application/views/scripts/list/downtimes.phtml
index 485782e3c..eaf4b7f8e 100644
--- a/modules/monitoring/application/views/scripts/list/downtimes.phtml
+++ b/modules/monitoring/application/views/scripts/list/downtimes.phtml
@@ -114,6 +114,7 @@ use Icinga\Module\Monitoring\Object\Service;
         <?php endif ?>
           </small>
         </td>
+        <?php if (isset($delDowntimeForm)): // Form is unset if the current user lacks the respective permission ?>
         <td style="width: 2em" data-base-target="self">
           <?php
           $delDowntimeForm = clone $delDowntimeForm;
@@ -126,6 +127,7 @@ use Icinga\Module\Monitoring\Object\Service;
           echo $delDowntimeForm;
           ?>
         </td>
+        <?php endif ?>
       </tr>
 <?php endforeach ?>
     </tbody>