diff --git a/app/main/controllers/upload/RTMediaUploadEndpoint.php b/app/main/controllers/upload/RTMediaUploadEndpoint.php
index fa2d1b6fb..5e5f6636a 100755
--- a/app/main/controllers/upload/RTMediaUploadEndpoint.php
+++ b/app/main/controllers/upload/RTMediaUploadEndpoint.php
@@ -86,11 +86,22 @@ public function template_redirect( $create_activity = true ) {
 				$model = new RTMediaUploadModel();
 				do_action( 'rtmedia_upload_set_post_object' );
 				$this->upload = $model->set_post_object();
+				unset( $this->upload['activity_id'] );
+
+				if ( -1 !== $_activity_id && ! empty( $_activity_id ) ) {
+					$can_attach = false;
+					// Query the activity to check if the activity belongs to the user.
+					if ( is_user_logged_in() && function_exists( 'bp_activity_get_specific' ) ) {
+						$activity = bp_activity_get_specific( array( 'activity_ids' => array( intval( $_activity_id ) ) ) );
+						if ( ! empty( $activity['activities'][0] ) && intval( $activity['activities'][0]->user_id ) === get_current_user_id() ) {
+							$can_attach = true;
+						}
+					}
 
-				if ( -1 !== $_activity_id ) {
-					$this->upload['activity_id'] = $_activity_id;
-					$activity_id                 = $_activity_id;
-
+					if ( $can_attach ) {
+						$this->upload['activity_id'] = $_activity_id;
+						$activity_id                 = $_activity_id;
+					}
 				}
 
 				// Media uploaded into a group takes its privacy from that group.