diff --git a/app/Http/Controllers/AttemptController.php b/app/Http/Controllers/AttemptController.php
index 27bcef6..bfae613 100644
--- a/app/Http/Controllers/AttemptController.php
+++ b/app/Http/Controllers/AttemptController.php
@@ -48,8 +48,12 @@ class AttemptController extends Controller
             abort(403);
         }
     }
-    public function show(Quiz $quiz)
+    public function show(int $quizId)
     {
+        // Bypass tenant global scope: candidates have no tenant_id
+        // but should still access their assigned quizzes
+        $quiz = Quiz::withoutGlobalScopes()->findOrFail($quizId);
+
         $candidate = auth()->user()->candidate;
 
         if (!$candidate) {