diff --git a/lib/web/controllers/phase_controller.ex b/lib/web/controllers/phase_controller.ex
index abe402596..7508507fd 100644
--- a/lib/web/controllers/phase_controller.ex
+++ b/lib/web/controllers/phase_controller.ex
@@ -54,6 +54,7 @@ defmodule Web.PhaseController do
 
     with {:ok, challenge} <- Challenges.get(challenge_id),
          {:ok, challenge} <- Challenges.allowed_to_edit(user, challenge),
+         {:ok, challenge} <- Challenges.allowed_to_view_submission(user, challenge),
          {:ok, phase} <- Phases.get(id) do
       submissions_filter =
         Map.merge(filter, %{