diff --git a/airflow/www/views.py b/airflow/www/views.py
index f62916e9f5f012..9618e35868d245 100644
--- a/airflow/www/views.py
+++ b/airflow/www/views.py
@@ -2982,6 +2982,11 @@ class PluginView(AirflowBaseView):
     ]
 
     @expose('/plugin')
+    @auth.has_access(
+        [
+            (permissions.ACTION_CAN_READ, permissions.RESOURCE_PLUGIN),
+        ]
+    )
     def list(self):
         """List loaded plugins."""
         plugins_manager.ensure_plugins_loaded()
diff --git a/tests/www/test_views.py b/tests/www/test_views.py
index c2c0ee6106df84..b4d1d4cebdba29 100644
--- a/tests/www/test_views.py
+++ b/tests/www/test_views.py
@@ -361,6 +361,12 @@ def test_should_list_entrypoint_plugins_on_page_with_details(self):
         self.check_content_in_response("source", resp)
         self.check_content_in_response("<em>test-entrypoint-testpluginview==1.0.0:</em> <Mock id=", resp)
 
+    def test_endpoint_should_not_be_unauthenticated(self):
+        self.logout()
+        resp = self.client.get('/plugin', follow_redirects=True)
+        self.check_content_not_in_response("test_plugin", resp)
+        self.check_content_in_response("Sign In - Airflow", resp)
+
 
 class TestPoolModelView(TestBase):
     def setUp(self):