Does the user have permission to update this project? You can limit the scope to user projects with something like:

    current_user.projects.find(params[:id])

This will only find projects that match the ID given AND are associated with the user.