diff --git a/services/nginx/app/routes/orderItemsRoute.php b/services/nginx/app/routes/orderItemsRoute.php
index 20d532ba..ca74179c 100644
--- a/services/nginx/app/routes/orderItemsRoute.php
+++ b/services/nginx/app/routes/orderItemsRoute.php
@@ -211,6 +211,7 @@ class orderItemsRoute
                 if (!isset($data['quantity'])) {
                     $response->error('Quantity is required', 400);
                 }
+
                 $orderItem = (new order_items_o())->getOrderItemById((int)$data['id']);
                 if (!$orderItem->exists()) {
                     $response->error('Order item not found', 404);
@@ -219,6 +220,17 @@ class orderItemsRoute
                 if ($product->requiresOrderItemNote() && trim((string)$data['notes']) === '') {
                     $response->error('Notes is required for this product', 400);
                 }
+
+                $order = (new orders_o())->getOrderById((int)$orderItem->order_id->value());
+                if (!$order->exists()) {
+                    $response->error('Order not found', 404);
+                }
+
+                $canAccessAllOrderItems = $this->hasPermission('list_order_items');
+                if (!$canAccessAllOrderItems && !$order->isOwnOrder((int)$user->customer_number->value())) {
+                    $response->error('Order item does not belong to the user', 403);
+                }
+
                 // Update the order item
                 (new order_items_o())->updateOrderItem((int)$data['id'], (int)$data['price'], (string)$data['notes'], (string)$data['reference'], (int)$data['quantity']);
                 // Log the incident