diff --git a/mod/hotpot/attempt.php b/mod/hotpot/attempt.php
index 344a577070d..3b7e1a9bb91 100644
--- a/mod/hotpot/attempt.php
+++ b/mod/hotpot/attempt.php
@@ -21,8 +21,10 @@
         error("Course Module ID is incorrect");
     }
 
-    // make sure this user is enrolled in this course
+    // make sure this user is enrolled in this course and can access this HotPot
     require_login($course);
+    $context = get_context_instance(CONTEXT_MODULE, $cm->id);
+    require_capability('mod/hotpot:attempt', $context);
 
     $next_url = "$CFG->wwwroot/course/view.php?id=$course->id";
     $time = time();
diff --git a/mod/hotpot/view.php b/mod/hotpot/view.php
index 52a1f44cbb3..f3110da542b 100644
--- a/mod/hotpot/view.php
+++ b/mod/hotpot/view.php
@@ -34,8 +34,10 @@
             }
 
         }
+        // make sure this user is enrolled in this course and can access this HotPot
         require_login($course);
         $context = get_context_instance(CONTEXT_MODULE, $cm->id);
+        require_capability('mod/hotpot:attempt', $context);
     }
     // set nextpage (for error messages)
     $nextpage = "$CFG->wwwroot/course/view.php?id=$course->id";