diff --git a/addons/hr_holidays/models/hr_leave.py b/addons/hr_holidays/models/hr_leave.py
index fc32dcaf984..91731074879 100644
--- a/addons/hr_holidays/models/hr_leave.py
+++ b/addons/hr_holidays/models/hr_leave.py
@@ -820,10 +820,13 @@ class HolidaysRequest(models.Model):
     def _unlink_if_correct_states(self):
         error_message = _('You cannot delete a time off which is in %s state')
         state_description_values = {elem[0]: elem[1] for elem in self._fields['state']._description_selection(self.env)}
+        now = fields.Datetime.now()
 
         if not self.user_has_groups('hr_holidays.group_hr_holidays_user'):
-            if any(hol.state != 'draft' for hol in self):
+            if any(hol.state not in ['draft', 'confirm'] for hol in self):
                 raise UserError(error_message % state_description_values.get(self[:1].state))
+            if any(hol.date_from < now for hol in self):
+                raise UserError(_('You cannot delete a time off which is in the past'))
         else:
             for holiday in self.filtered(lambda holiday: holiday.state not in ['draft', 'cancel', 'confirm']):
                 raise UserError(error_message % (state_description_values.get(holiday.state),))
diff --git a/addons/hr_holidays/security/hr_holidays_security.xml b/addons/hr_holidays/security/hr_holidays_security.xml
index ce0bdd0f872..2dbc27fff90 100644
--- a/addons/hr_holidays/security/hr_holidays_security.xml
+++ b/addons/hr_holidays/security/hr_holidays_security.xml
@@ -61,7 +61,7 @@
     <record id="hr_leave_rule_employee_unlink" model="ir.rule">
         <field name="name">Time Off base.group_user unlink</field>
         <field name="model_id" ref="model_hr_leave"/>
-        <field name="domain_force">[('employee_id.user_id', '=', user.id), ('state', '=', 'draft')]</field>
+        <field name="domain_force">[('employee_id.user_id', '=', user.id), ('state', 'in', ['draft', 'confirm'])]</field>
         <field name="perm_read" eval="False"/>
         <field name="perm_write" eval="False"/>
         <field name="perm_create" eval="False"/>
diff --git a/addons/hr_holidays/tests/test_access_rights.py b/addons/hr_holidays/tests/test_access_rights.py
index 45aafba8af2..dc1df2cc908 100644
--- a/addons/hr_holidays/tests/test_access_rights.py
+++ b/addons/hr_holidays/tests/test_access_rights.py
@@ -77,7 +77,9 @@ class TestHrHolidaysAccessRightsCommon(TestHrHolidaysCommon):
     def request_leave(self, user_id, date_from, number_of_days, values=None):
         values = dict(values or {}, **{
             'date_from': date_from,
+            'request_date_from': date_from,
             'date_to': date_from + relativedelta(days=number_of_days),
+            'request_date_to': date_from + relativedelta(days=number_of_days),
             'number_of_days': number_of_days,
         })
         return self.env['hr.leave'].with_user(user_id).create(values)
@@ -715,6 +717,56 @@ class TestAccessRightsWrite(TestHrHolidaysAccessRightsCommon):
 
     # TODO Can always cancel with great powers comes great responbilities
 
+class TestAccessRightsUnlink(TestHrHolidaysAccessRightsCommon):
+
+    # base.group_user
+
+    @mute_logger('odoo.models.unlink', 'odoo.addons.mail.models.mail_mail')
+    def test_leave_unlink_draft_by_user(self):
+        """ A simple user may delete its leave in draft state in the future"""
+        values = {
+            'name': 'Random Leave',
+            'employee_id': self.employee_emp.id,
+            'holiday_status_id': self.leave_type.id,
+            'state': 'draft',
+        }
+        leave = self.request_leave(self.user_employee_id, datetime.now() + relativedelta(days=6), 1, values)
+        leave.with_user(self.user_employee.id).unlink()
+
+    def test_leave_unlink_confirm_by_user(self):
+        """ A simple user may delete its leave in confirm state in the future"""
+        values = {
+            'name': 'Random Leave',
+            'employee_id': self.employee_emp.id,
+            'holiday_status_id': self.leave_type.id,
+            'state': 'confirm',
+        }
+        leave = self.request_leave(self.user_employee_id, datetime.now() + relativedelta(days=6), 1, values)
+        leave.with_user(self.user_employee.id).unlink()
+
+    def test_leave_unlink_confirm_in_past_by_user(self):
+        """ A simple user cannot delete its leave in the past"""
+        values = {
+            'name': 'Random Leave',
+            'employee_id': self.employee_emp.id,
+            'holiday_status_id': self.leave_type.id,
+            'state': 'confirm',
+        }
+        leave = self.request_leave(self.user_employee_id, datetime.now() + relativedelta(days=-4), 1, values)
+        with self.assertRaises(UserError), self.cr.savepoint():
+            leave.with_user(self.user_employee.id).unlink()
+
+    def test_leave_unlink_validate_by_user(self):
+        """ A simple user cannot delete its leave in validate state"""
+        values = {
+            'name': 'Random Leave',
+            'employee_id': self.employee_emp.id,
+            'holiday_status_id': self.leave_type.id,
+        }
+        leave = self.request_leave(self.user_employee_id, datetime.now() + relativedelta(days=6), 1, values)
+        leave.with_user(self.user_hrmanager_id).write({'state': 'validate'})
+        with self.assertRaises(UserError), self.cr.savepoint():
+            leave.with_user(self.user_employee.id).unlink()
 
 class TestMultiCompany(TestHrHolidaysCommon):