diff --git a/sys/kern/vfs_quota.c b/sys/kern/vfs_quota.c
--- a/sys/kern/vfs_quota.c
+++ b/sys/kern/vfs_quota.c
@@ -40,6 +40,7 @@
 #include <sys/vfs_quota.h>
 #include <sys/spinlock.h>
 #include <sys/spinlock2.h>
+#include <sys/caps.h>
 
 #include <sys/sysmsg.h>
 #include <libprop/proplib.h>
@@ -341,6 +342,16 @@
 
 	if (!vfs_quota_enabled)
 		return EOPNOTSUPP;
+	/*
+	 * Require privilege to manipulate VFS quotas. The UFS quota ioctls
+	 * gate writes with SYSCAP_NOQUOTA_WR; sys_vquotactl must do the same,
+	 * otherwise any unprivileged user can set filesystem-wide limits
+	 * (write DoS), set/remove per-uid/gid limits, and read every user's
+	 * disk usage on quota-enabled filesystems.
+	 */
+	error = caps_priv_check_td(curthread, SYSCAP_NOQUOTA_WR);
+	if (error)
+		return (error);
 	path = vqa->path;
 	error = copyin(vqa->pref, &pref, sizeof(pref));
 	error = prop_dictionary_copyin(&pref, &dict);