diff --git a/src/main/java/com/youlai/boot/system/controller/MenuController.java b/src/main/java/com/youlai/boot/system/controller/MenuController.java
index 9e12a798..f8064bc9 100644
--- a/src/main/java/com/youlai/boot/system/controller/MenuController.java
+++ b/src/main/java/com/youlai/boot/system/controller/MenuController.java
@@ -1,15 +1,14 @@
 package com.youlai.boot.system.controller;
 
-import com.youlai.boot.common.result.Result;
-import com.youlai.boot.common.enums.LogModuleEnum;
+import com.youlai.boot.common.annotation.Log;
 import com.youlai.boot.common.annotation.RepeatSubmit;
+import com.youlai.boot.common.enums.LogModuleEnum;
+import com.youlai.boot.common.model.Option;
+import com.youlai.boot.common.result.Result;
 import com.youlai.boot.system.model.form.MenuForm;
 import com.youlai.boot.system.model.query.MenuQuery;
 import com.youlai.boot.system.model.vo.MenuVO;
-import com.youlai.boot.common.model.Option;
 import com.youlai.boot.system.model.vo.RouteVO;
-import com.youlai.boot.common.annotation.Log;
-import com.youlai.boot.core.security.util.SecurityUtils;
 import com.youlai.boot.system.service.MenuService;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.Parameter;
@@ -20,7 +19,6 @@ import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import java.util.List;
-import java.util.Set;
 
 /**
  * 菜单控制层
@@ -64,6 +62,7 @@ public class MenuController {
 
     @Operation(summary = "菜单表单数据")
     @GetMapping("/{id}/form")
+    @PreAuthorize("@ss.hasPerm('sys:menu:edit')")
     public Result<MenuForm> getMenuForm(
             @Parameter(description = "菜单ID") @PathVariable Long id
     ) {
diff --git a/src/main/java/com/youlai/boot/system/controller/RoleController.java b/src/main/java/com/youlai/boot/system/controller/RoleController.java
index cc8e6f7f..a8a062f2 100644
--- a/src/main/java/com/youlai/boot/system/controller/RoleController.java
+++ b/src/main/java/com/youlai/boot/system/controller/RoleController.java
@@ -64,6 +64,7 @@ public class RoleController {
 
     @Operation(summary = "获取角色表单数据")
     @GetMapping("/{roleId}/form")
+    @PreAuthorize("@ss.hasPerm('sys:role:edit')")
     public Result<RoleForm> getRoleForm(
             @Parameter(description = "角色ID") @PathVariable Long roleId
     ) {
diff --git a/src/main/java/com/youlai/boot/system/controller/UserController.java b/src/main/java/com/youlai/boot/system/controller/UserController.java
index a1a1bd80..87a1c5a1 100644
--- a/src/main/java/com/youlai/boot/system/controller/UserController.java
+++ b/src/main/java/com/youlai/boot/system/controller/UserController.java
@@ -156,6 +156,7 @@ public class UserController {
 
     @Operation(summary = "导入用户")
     @PostMapping("/import")
+    @PreAuthorize("@ss.hasPerm('sys:user:import')")
     @Log(value = "导入用户", module = LogModuleEnum.USER)
     public Result<ExcelResult> importUsers(MultipartFile file) throws IOException {
         UserImportListener listener = new UserImportListener();
@@ -165,6 +166,7 @@ public class UserController {
 
     @Operation(summary = "导出用户")
     @GetMapping("/export")
+    @PreAuthorize("@ss.hasPerm('sys:user:export')")
     @Log(value = "导出用户", module = LogModuleEnum.USER)
     public void exportUsers(UserPageQuery queryParams, HttpServletResponse response) throws IOException {
         String fileName = "用户列表.xlsx";