diff --git a/app/controllers/discussion_locks_controller.rb b/app/controllers/discussion_locks_controller.rb
index 8842bb9a1..5480f9d0f 100644
--- a/app/controllers/discussion_locks_controller.rb
+++ b/app/controllers/discussion_locks_controller.rb
@@ -8,6 +8,7 @@ class DiscussionLocksController < ApplicationController
 
     authorize @discussion_lock
     article = Article.find(discussion_lock_params[:article_id])
+    authorize article, :discussion_lock_confirm?
 
     if @discussion_lock.save
       bust_article_cache(article)
diff --git a/spec/requests/discussion_locks_spec.rb b/spec/requests/discussion_locks_spec.rb
index 760de7835..b2edaaf16 100644
--- a/spec/requests/discussion_locks_spec.rb
+++ b/spec/requests/discussion_locks_spec.rb
@@ -43,6 +43,20 @@ RSpec.describe "DiscussionLocks", type: :request do
 
       expect(cache_buster).to have_received(:call).with(article).once
     end
+
+    it "does not allow to lock another user's article" do
+      article = create(:article, user: user)
+      other_user = create(:user)
+      sign_out user
+      sign_in other_user
+
+      reason = "Unproductice comments."
+      notes = "Hostile comment from user @user"
+      valid_attributes = { article_id: article.id, locking_user_id: other_user.id, notes: notes, reason: reason }
+      expect do
+        post discussion_locks_path, params: { discussion_lock: valid_attributes }
+      end.to raise_error(Pundit::NotAuthorizedError)
+    end
   end
 
   describe "DELETE /discussion_locks/:id - DiscussionLocks#destroy" do