Index: backend/src/main/java/medora/controller/AppointmentController.java
===================================================================
--- backend/src/main/java/medora/controller/AppointmentController.java	(revision e5d5ff9cb218e6c76b1a61931d2095ae3dcf48b5)
+++ backend/src/main/java/medora/controller/AppointmentController.java	(revision f18b11be234397c492a2b9b7384cd8e3ce7a31dd)
@@ -243,5 +243,5 @@
             }
 
-            // Verify appointment exists and check permissions for patients
+            // Verify appointment exists and check permissions
             Appointment appointment = appointmentService.getAppointmentById(appointmentId)
                     .orElseThrow(() -> new RuntimeException("Appointment not found"));
@@ -251,4 +251,11 @@
                 Long appointmentPatientId = appointment.getPatient() != null ? appointment.getPatient().getPatientId() : null;
                 if (patientIdFromToken == null || !patientIdFromToken.equals(appointmentPatientId)) {
+                    return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                            .body(Map.of("error", "You can only cancel your own appointments"));
+                }
+            } else if (role.equals("DOCTOR")) {
+                Long doctorIdFromToken = securityUtil.getDoctorIdFromRequest(httpRequest);
+                Long appointmentDoctorId = appointment.getDoctor() != null ? appointment.getDoctor().getDoctorId() : null;
+                if (doctorIdFromToken == null || !doctorIdFromToken.equals(appointmentDoctorId)) {
                     return ResponseEntity.status(HttpStatus.FORBIDDEN)
                             .body(Map.of("error", "You can only cancel your own appointments"));