diff --git a/services/nginx/app/routes/departmentSelfserveTasksRoute.php b/services/nginx/app/routes/departmentSelfserveTasksRoute.php
index 6280354c..71a56d2b 100644
--- a/services/nginx/app/routes/departmentSelfserveTasksRoute.php
+++ b/services/nginx/app/routes/departmentSelfserveTasksRoute.php
@@ -384,11 +384,14 @@ class departmentSelfserveTasksRoute
                     }
                 }
 
-                $attachment = $task_o->getAttachment($attachment_id);
-                if (!$attachment->exists()) {
+                $task_attachments = $task_o->listAttachments();
+                $task_attachment_ids = array_map(static fn($attachment) => (int)$attachment->id, $task_attachments);
+                if (!in_array($attachment_id, $task_attachment_ids, true)) {
                     $response->error('Attachment not found', 404);
                 }
 
+                $attachment = $task_o->getAttachment($attachment_id);
+
                 $attachment_store = new attachment_store();
                 $attachments = new attachments();
                 $attachment_formatted = $attachments->format($attachment);
@@ -511,6 +514,12 @@ class departmentSelfserveTasksRoute
                     $response->error('You do not have access to this department', 403);
                 }
 
+                $task_attachments = $task_o->listAttachments();
+                $task_attachment_ids = array_map(static fn($attachment) => (int)$attachment->id, $task_attachments);
+                if (!in_array($attachment_id, $task_attachment_ids, true)) {
+                    $response->error('Attachment not found', 404);
+                }
+
                 $task_o->removeAttachment($attachment_id);
                 
                 (new logs_o())->add('department_selfserve_tasks', (int)$task_o->department->value(), 1, $user->id, 'DELETE_TASK_ATTACHMENT', 'User deleted attachment ID: ' . $attachment_id . ' for task ID: ' . $task_id);