diff --git a/backend/src/routes/projects.ts b/backend/src/routes/projects.ts
index bea8ecab..ea24f071 100644
--- a/backend/src/routes/projects.ts
+++ b/backend/src/routes/projects.ts
@@ -828,6 +828,7 @@ projectsRouter.delete("/:projectId/folders/:folderId", requireAuth, async (req,
 
   const access = await checkProjectAccess(projectId, userId, userEmail, db);
   if (!access.ok) return void res.status(404).json({ detail: "Project not found" });
+  if (!access.isOwner) return void res.status(404).json({ detail: "Project not found" });
 
   const { data: allFolders, error: foldersError } = await db
     .from("project_subfolders")