diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 6cb6f63..ef6b866 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -8,6 +8,7 @@ class UsersController < ApplicationController
 
   def show
     @user = User.find_by(name: params[:id]) || User.new
+    authorize! :read, @user
     respond_to do |format|
       format.html { @transaction = Transaction.new }
       format.json { render json: @user }