diff --git a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseAttachmentController.java b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseAttachmentController.java
index d34ccadc..337eeb42 100644
--- a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseAttachmentController.java
+++ b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseAttachmentController.java
@@ -141,6 +141,7 @@ public class CourseAttachmentController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.COURSE)
     @PutMapping("/update/sort")
     @Log(title = "线上课-附件-排序调整", businessType = BusinessTypeConstant.UPDATE)
     public JsonResponse updateSort(
diff --git a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java
index 8b0273d3..7d7359af 100644
--- a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java
+++ b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java
@@ -95,6 +95,7 @@ public class CourseChapterController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.COURSE)
     @PutMapping("/update/sort")
     @Log(title = "线上课-章节-更新排序", businessType = BusinessTypeConstant.UPDATE)
     public JsonResponse updateSort(
diff --git a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java
index 63bbe14e..c373593d 100644
--- a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java
+++ b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java
@@ -224,6 +224,7 @@ public class CourseHourController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.COURSE)
     @PutMapping("/update/sort")
     @Log(title = "线上课-课时-更新排序", businessType = BusinessTypeConstant.UPDATE)
     public JsonResponse updateSort(
diff --git a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/UserController.java b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/UserController.java
index fb4ef9ba..36c9b63e 100644
--- a/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/UserController.java
+++ b/playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/UserController.java
@@ -262,6 +262,7 @@ public class UserController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.USER_STORE)
     @PostMapping("/store-batch")
     @Transactional
     @Log(title = "学员-批量导入", businessType = BusinessTypeConstant.INSERT)