diff --git a/functions/api/game-appeals/[id]/_middleware.ts b/functions/api/game-appeals/[id]/_middleware.ts
index c342102..03e6d34 100644
--- a/functions/api/game-appeals/[id]/_middleware.ts
+++ b/functions/api/game-appeals/[id]/_middleware.ts
@@ -1,6 +1,11 @@
 import { jsonError } from "../../../common.js";
 
 export async function onRequest(context: RequestContext) {
+  const { pathname } = new URL(context.request.url);
+
+  if (pathname.endsWith("/metadata") || pathname.endsWith("/submit"))
+    return await context.next();
+
   if (!(context.data.current_user.permissions & (1 << 5)))
     return jsonError("Forbidden", 403);