diff --git a/src/main/java/org/hbp/mip/controllers/ArticlesApi.java b/src/main/java/org/hbp/mip/controllers/ArticlesApi.java
index bfa076087eee1811e6f22023222af7ead92b8948..01613d84f7ccca588c600d87860525bc204ac624 100644
--- a/src/main/java/org/hbp/mip/controllers/ArticlesApi.java
+++ b/src/main/java/org/hbp/mip/controllers/ArticlesApi.java
@@ -45,7 +45,7 @@ public class ArticlesApi {
 
         User user = mipApplication.getUser();
 
-        String queryString = "SELECT a FROM Article a, User u WHERE a.createdBy=u.id";
+        String queryString = "SELECT a FROM Article a, User u WHERE a.createdBy=u.username";
         if(status != null)
         {
             queryString += " AND status= :status";
@@ -58,7 +58,8 @@ public class ArticlesApi {
         {
             if(team != null && team)
             {
-                queryString += " AND u.team= :team";
+                // TODO: decide if this is needed
+                //queryString += " AND u.team= :team";
             }
         }
 
@@ -74,7 +75,8 @@ public class ArticlesApi {
                 query.setString("username", user.getUsername());
             } else {
                 if (team != null && team) {
-                    query.setString("team", user.getTeam());
+                    // TODO: decide if this is needed
+                    //query.setString("team", user.getTeam());
                 }
             }
             articles = query.list();
@@ -210,10 +212,23 @@ public class ArticlesApi {
             @RequestBody @ApiParam(value = "Article to update", required = true) @Valid Article article
     ) {
 
+        User user = mipApplication.getUser();
+
         Session session = HibernateUtil.getSessionFactory().getCurrentSession();
         try{
             session.beginTransaction();
 
+            String author = (String) session
+                    .createQuery("select U.username from User U, Article A where A.createdBy = U.username and A.slug = :slug")
+                    .setString("slug", slug)
+                    .uniqueResult();
+
+            if(!user.getUsername().equals(author))
+            {
+                session.getTransaction().commit();
+                return new ResponseEntity<>(HttpStatus.FORBIDDEN);
+            }
+
             String oldTitle = (String) session
                     .createQuery("select title from Article where slug= :slug")
                     .setString("slug", slug)
diff --git a/src/main/java/org/hbp/mip/controllers/ModelsApi.java b/src/main/java/org/hbp/mip/controllers/ModelsApi.java
index 5194e2787b106eed8af5486daeed9496e4606fae..98e29e4247f49adb9bc7ca5b259e60bb6e91bb1a 100644
--- a/src/main/java/org/hbp/mip/controllers/ModelsApi.java
+++ b/src/main/java/org/hbp/mip/controllers/ModelsApi.java
@@ -44,7 +44,7 @@ public class ModelsApi {
 
         User user = mipApplication.getUser();
 
-        String queryString = "SELECT m FROM Model m, User u WHERE m.createdBy=u.id";
+        String queryString = "SELECT m FROM Model m, User u WHERE m.createdBy=u.username";
         if(own != null && own)
         {
             queryString += " AND u.username= :username";
@@ -53,7 +53,8 @@ public class ModelsApi {
         {
             if(team != null && team)
             {
-                queryString += " AND u.team= :team";
+                // TODO: decide if this is needed
+                //queryString += " AND u.team= :team";
             }
         }
 
@@ -70,7 +71,8 @@ public class ModelsApi {
             {
                 if(team != null && team)
                 {
-                    query.setString("team", user.getTeam());
+                    // TODO: decide if this is needed
+                    //query.setString("team", user.getTeam());
                 }
             }
             if(limit != null)
@@ -288,6 +290,17 @@ public class ModelsApi {
         try{
             session.beginTransaction();
 
+            String author = (String) session
+                    .createQuery("select U.username from User U, Model M where M.createdBy = U.username and M.slug = :slug")
+                    .setString("slug", slug)
+                    .uniqueResult();
+
+            if(!user.getUsername().equals(author))
+            {
+                session.getTransaction().commit();
+                return new ResponseEntity<>(HttpStatus.FORBIDDEN);
+            }
+
             String oldTitle = (String) session
                     .createQuery("select title from Model where slug= :slug")
                     .setString("slug", slug)