Thanks for your feedback, looking at it asap.

Attached a patch that fixes this issue.

Root cause: The check_parsed_query() method in BP_Members_Component triggers a 404 before the navigation access control can redirect non-logged-in users to the login page.
When a user clicks an invitation link while logged out, the screen function isn't hooked (because access is denied), so check_parsed_query() sees no callable function and immediately returns 404.

Fix: Before calling bp_do_404(), check if:

1. The user is not logged in
2. A nav item exists for this action
3. The nav item has user_has_access set to false

If all conditions are met, call bp_core_no_access() to redirect to login instead of showing 404.

Commit: ​https://github.com/vapvarun/BuddyPress/commit/3ad8bbb1ac7301a6a35bf96fed86b8ae1dec586e

Tested locally - clicking /members/{user}/groups/invites/ while logged out now redirects to the login page as expected.

@vapvarun Could you help me understand the issue better? If I try to access this link while logged out: ​https://bp.test/members/my-user/groups/invites, I'm redirected to the login page. The code from your patch doesn't seem to be run at all. Could you help understand how you are replicating this issue?

@drwebbe I'm not sure which page is that. As far as I know, https://site.com/members/groups/invites/ this page doesn't exist for logged in users or not.

@espellcaste You're right - I re-tested and can't reproduce this either.

Sent an actual group invitation and clicked the link while logged out. Both master and my patch branch correctly redirect to the login page (302 with bp-auth=1).

The redirect happens earlier in the flow via bp_core_register_subnav_screen_function() at priority 12, so my patch code in check_parsed_query() (priority 999) never gets hit.

I initially patched based on code analysis without testing on clean master first - my mistake.

Since this works correctly on current trunk, I'd suggest marking as "worksforme". The original report was from BP 10.3.0 - possibly fixed since then.

Happy to withdraw the patch.