diff --git a/CHANGELOG.md b/CHANGELOG.md
index b5637083df..b45755b5c2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,8 @@
 # Changelog
 
+## v5.0.3
+- fix(policy): harden authorization for plan resources [#3613](https://github.com/DMPRoadmap/roadmap/pull/3613)
+
 ## v5.0.2
 - Bump Ruby to v3.1.4 and use `.ruby-version` in CI
   - [#3566](https://github.com/DMPRoadmap/roadmap/pull/3566)
diff --git a/app/controllers/contributors_controller.rb b/app/controllers/contributors_controller.rb
index e260dbd731..1d4e2719bc 100644
--- a/app/controllers/contributors_controller.rb
+++ b/app/controllers/contributors_controller.rb
@@ -12,13 +12,13 @@ class ContributorsController < ApplicationController
 
   # GET /plans/:plan_id/contributors
   def index
-    authorize @plan
+    authorize @plan, :show?
     @contributors = @plan.contributors
   end
 
   # GET /plans/:plan_id/contributors/new
   def new
-    authorize @plan
+    authorize @plan, :edit?
     default_org = @plan.org.present? ? @plan.org : current_user.org
     @contributor = Contributor.new(plan: @plan, org: default_org)
   end