"Access denied" when updating a recurring contribution

In 5.10.4, when I make a recurring contribution, the receipt sent to me includes a link to update the recurring contribution.

As an anonymous user, when I click on that link, I get an access denied message ("Ensure you are still logged in and have permission to access this feature"). Sometimes this prevents me updating the contribution (the form is read only) and other times I can edit it.

The URL in the email is https://example.com/civicrm/contribute/updaterecur?reset=1&coid=xxxxx&cs=xxxxxxxxxxxxx_xxxxxxx_inf

The URL which throws the 403 is https://example.com/civicrm/custom?type=ContributionRecur&entityID=xxx&qf=xxxxxx_xxxx&action=2&cgcount=1&snippet=json