diff --git a/CHANGELOG.md b/CHANGELOG.md
index fb5dfe30a..a80d2dec9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,14 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ### Deprecations/Changes
 
+* permissions: Fix bug in _Host Sets_ service that authenticated requests  
+  againist incorrect grant actions. This bug affects the _SetHosts_, _AddHosts_ 
+  and _RemoveHosts_ paths that do not have wildcard (`*`) action grants. 
+  If affected, please update grant actions as follows:
+* * `set-host-sets` -> `set-hosts`
+* * `add-host-sets` -> `add-hosts`
+* * `remove-host-sets` -> `remove-hosts` 
+  ([PR](https://github.com/hashicorp/boundary/pull/1549)).
 * Removes support for the `auth-methods/<id>:authenticate:login` action that was 
   deprecated in [Boundary 0.2.0](#020-20210414), please use 
   `auth-methods/<id>:authenticate` instead.
diff --git a/internal/servers/controller/handlers/host_sets/host_set_service.go b/internal/servers/controller/handlers/host_sets/host_set_service.go
index a251efaca..0b354560d 100644
--- a/internal/servers/controller/handlers/host_sets/host_set_service.go
+++ b/internal/servers/controller/handlers/host_sets/host_set_service.go
@@ -267,7 +267,7 @@ func (s Service) AddHostSetHosts(ctx context.Context, req *pbs.AddHostSetHostsRe
 	if err := validateAddRequest(req); err != nil {
 		return nil, err
 	}
-	_, authResults := s.parentAndAuthResult(ctx, req.GetId(), action.AddHostSets)
+	_, authResults := s.parentAndAuthResult(ctx, req.GetId(), action.AddHosts)
 	if authResults.Error != nil {
 		return nil, authResults.Error
 	}
@@ -305,7 +305,7 @@ func (s Service) SetHostSetHosts(ctx context.Context, req *pbs.SetHostSetHostsRe
 	if err := validateSetRequest(req); err != nil {
 		return nil, err
 	}
-	_, authResults := s.parentAndAuthResult(ctx, req.GetId(), action.SetHostSets)
+	_, authResults := s.parentAndAuthResult(ctx, req.GetId(), action.SetHosts)
 	if authResults.Error != nil {
 		return nil, authResults.Error
 	}
@@ -342,7 +342,7 @@ func (s Service) RemoveHostSetHosts(ctx context.Context, req *pbs.RemoveHostSetH
 	if err := validateRemoveRequest(req); err != nil {
 		return nil, err
 	}
-	_, authResults := s.parentAndAuthResult(ctx, req.GetId(), action.RemoveHostSets)
+	_, authResults := s.parentAndAuthResult(ctx, req.GetId(), action.RemoveHosts)
 	if authResults.Error != nil {
 		return nil, authResults.Error
 	}