diff --git a/app/controllers/concerns/enlistment_filters.rb b/app/controllers/concerns/enlistment_filters.rb
index 4a65c82e4..b73939414 100644
--- a/app/controllers/concerns/enlistment_filters.rb
+++ b/app/controllers/concerns/enlistment_filters.rb
@@ -28,7 +28,7 @@ def parse_sort_term
   end
 
   def find_enlistment
-    @enlistment = Enlistment.find_by(id: params[:id])
+    @enlistment = @project.enlistments.find_by(id: params[:id])
     raise ParamRecordNotFound unless @enlistment
 
     @enlistment.editor_account = current_user
diff --git a/test/controllers/enlistments_controller_test.rb b/test/controllers/enlistments_controller_test.rb
index 437cad811..42ab9881c 100644
--- a/test/controllers/enlistments_controller_test.rb
+++ b/test/controllers/enlistments_controller_test.rb
@@ -379,6 +379,16 @@ class EnlistmentsControllerTest < ActionController::TestCase
     assert_response :ok
     assert_template :show
   end
+
+  it 'show returns 404 when enlistment belongs to a different project' do
+    login_as @account
+    other_enlistment = create(:enlistment)
+    client_id = create(:api_key).oauth_application.uid
+
+    get :show, params: { project_id: @project_id, id: other_enlistment.id, format: :xml, api_key: client_id }
+
+    assert_response :not_found
+  end
 end
 
 # rubocop:disable Style/OptionalArguments