diff --git a/app/controllers/assignments_controller.rb b/app/controllers/assignments_controller.rb
index 6270499f07cfcbb7a2b4da89578e88b959ffb69a..49111fafe22f2f8a7852333bfc50df8ddeaea461 100644
--- a/app/controllers/assignments_controller.rb
+++ b/app/controllers/assignments_controller.rb
@@ -22,8 +22,8 @@ class AssignmentsController < ApplicationController
       return
     end
 
-    @session = Session.find_by(ref_id: params[:session_ref_id])
     @conference = Conference.find_by(slug: params[:conference_slug])
+    @session = Session.find_by(conference: @conference, ref_id: params[:session_ref_id])
     @user = User.find(params[:user_id])
     @assignment = Assignment.new(user: @user, session: @session)
 
@@ -115,7 +115,8 @@ class AssignmentsController < ApplicationController
   private
 
   def set_session
-    @session = Session.find_by(ref_id: params[:session_ref_id])
+    conference = Conference.find_by(slug: params[:conference_slug])
+    @session = Session.find_by(conference:, ref_id: params[:session_ref_id])
   end
 
   def set_users
diff --git a/app/controllers/candidates_controller.rb b/app/controllers/candidates_controller.rb
index 94bff982598118290861808d7f42796fe433fb8e..c5f3f0466c07d0f4220c1bba2c2f89fd0e2bc1df 100644
--- a/app/controllers/candidates_controller.rb
+++ b/app/controllers/candidates_controller.rb
@@ -4,8 +4,8 @@ class CandidatesController < ApplicationController
   before_action :authorize_shiftcoordinator, except: [:create, :destroy_self]
 
   def create
-    @session = Session.find_by(ref_id: params[:session_ref_id])
     @conference = Conference.find_by(slug: params[:conference_slug])
+    @session = Session.find_by(conference: @conference, ref_id: params[:session_ref_id])
     @candidate = Candidate.find_or_initialize_by(user: current_user, session: @session).tap do |candidate_|
       candidate_.note = params[:note]
       candidate_.save!
@@ -35,13 +35,15 @@ class CandidatesController < ApplicationController
   end
 
   def destroy
+    conference = Conference.find_by(slug: params[:conference_slug])
     @candidate = Candidate.find(params[:id])
-    @session = Session.find_by(ref_id: params[:session_ref_id])
+    @session = Session.find_by(conference:, ref_id: params[:session_ref_id])
     destroy_candidate(@session, @candidate)
   end
 
   def destroy_self
-    @session = Session.find_by(ref_id: params[:session_ref_id])
+    conference = Conference.find_by(slug: params[:conference_slug])
+    @session = Session.find_by(conference:, ref_id: params[:session_ref_id])
     @candidate = Candidate.find_by(user: current_user, session: @session)
     destroy_candidate(@session, @candidate)
   end
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 2feb7efa69a0e4b820a4f2ca79a63fc61ab5111b..e0aa59e6388a5a416b9d5a644ef1a908734508c8 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -19,7 +19,7 @@ class SessionsController < ApplicationController
 
   def show
     @conference = Conference.find_by(slug: params[:slug])
-    @session = Session.includes(:stage).find_by(ref_id: params[:ref_id])
+    @session = Session.includes(:stage).find_by(conference: @conference, ref_id: params[:ref_id])
     @users = User.all
   end
 end