diff --git a/services/api/src/modules/study/data/repositories/questions.ts b/services/api/src/modules/study/data/repositories/questions.ts
index 992417dd..8e2aa875 100644
--- a/services/api/src/modules/study/data/repositories/questions.ts
+++ b/services/api/src/modules/study/data/repositories/questions.ts
@@ -3,7 +3,7 @@ import { appInstance } from '@utils/types'
 import { BadRequestError, QueryParams } from 'equipped'
 import { IQuestionRepository } from '../../domain/irepositories/questions'
 import { QuestionMapper } from '../mappers/questions'
-import { QuestionToModel } from '../models/questions'
+import { QuestionFromModel, QuestionToModel } from '../models/questions'
 import { Question } from '../mongooseModels/questions'
 import { Quiz } from '../mongooseModels/quizzes'
 
@@ -40,10 +40,15 @@ export class QuestionRepository implements IQuestionRepository {
 	}
 
 	async update (quizId: string, id: string, userId: string, data: Partial<QuestionToModel>) {
-		const question = await Question.findOneAndUpdate({
-			_id: id, userId, quizId
-		}, { $set: data }, { new: true })
-		return this.mapper.mapFrom(question)
+		let res = null as QuestionFromModel | null
+		await Question.collection.conn.transaction(async (session) => {
+			const quiz = await Quiz.findById(quizId, {}, { session })
+			if (!quiz|| !quiz.access.members.concat(quiz.user.id).includes(userId)) return
+			const question = await Question.findOneAndUpdate({ _id: id, quizId }, { $set: data }, { new: true })
+			res = question
+			return res
+		})
+		return this.mapper.mapFrom(res)
 	}
 
 	async delete (quizId: string, id: string, userId: string) {