diff --git a/src/main/java/xyz/playedu/api/controller/backend/DepartmentController.java b/src/main/java/xyz/playedu/api/controller/backend/DepartmentController.java
index 487d46c..355a737 100644
--- a/src/main/java/xyz/playedu/api/controller/backend/DepartmentController.java
+++ b/src/main/java/xyz/playedu/api/controller/backend/DepartmentController.java
@@ -160,12 +160,14 @@ public class DepartmentController {
         return JsonResponse.success();
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.DEPARTMENT_CUD)
     @PutMapping("/update/sort")
     public JsonResponse resort(@RequestBody @Validated DepartmentSortRequest req) {
         departmentService.resetSort(req.getIds());
         return JsonResponse.success();
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.DEPARTMENT_CUD)
     @PutMapping("/update/parent")
     public JsonResponse updateParent(@RequestBody @Validated DepartmentParentRequest req)
             throws NotFoundException {