diff --git a/src/main/java/com/gxwebsoft/common/system/controller/MainController.java b/src/main/java/com/gxwebsoft/common/system/controller/MainController.java
index dd7729a..5b740d5 100644
--- a/src/main/java/com/gxwebsoft/common/system/controller/MainController.java
+++ b/src/main/java/com/gxwebsoft/common/system/controller/MainController.java
@@ -45,6 +45,7 @@ import com.gxwebsoft.common.system.result.TenantOption;
 import com.gxwebsoft.common.system.result.AccountInfoResult;
 import com.gxwebsoft.common.system.result.CheckPhoneResult;
 import com.gxwebsoft.common.system.service.*;
+import com.gxwebsoft.common.system.mapper.UserMapper;
 import com.gxwebsoft.common.system.util.EmailTemplateUtil;
 import com.wf.captcha.SpecCaptcha;
 import io.jsonwebtoken.Claims;
@@ -88,6 +89,8 @@ public class MainController extends BaseController {
   @Resource
   private UserService userService;
   @Resource
+  private UserMapper userMapper;
+  @Resource
   private RoleMenuService roleMenuService;
   @Resource
   private LoginRecordService loginRecordService;
@@ -1520,13 +1523,9 @@ public class MainController extends BaseController {
 
     // ===== 模式判断：userId 为空时按手机号查所有用户统一重置 =====
     if (StrUtil.isBlank(param.getUserId())) {
-      // 通过手机号查找所有用户（跨租户）
-      List<User> userList = userService.list(
-          new LambdaQueryWrapper<User>()
-              .eq(User::getPhone, param.getPhone())
-              .eq(User::getDeleted, 0)
-      );
-      if (userList.isEmpty()) {
+      // 通过手机号查找所有用户（跨租户，忽略租户隔离）
+      List<User> userList = userMapper.selectAccountsByPhone(param.getPhone());
+      if (userList == null || userList.isEmpty()) {
         return fail("该手机号未注册");
       }
       // 过滤掉被冻结的账号
@@ -1542,7 +1541,7 @@ public class MainController extends BaseController {
         User update = new User();
         update.setUserId(u.getUserId());
         update.setPassword(encodedPassword);
-        userService.updateById(update);
+        userMapper.updateByUserId(update);
         // 记录登录日志
         LoginRecord record = new LoginRecord();
         record.setUsername(u.getUsername());
diff --git a/src/main/java/com/gxwebsoft/common/system/mapper/xml/UserMapper.xml b/src/main/java/com/gxwebsoft/common/system/mapper/xml/UserMapper.xml
index 38a859e..5bc690a 100644
--- a/src/main/java/com/gxwebsoft/common/system/mapper/xml/UserMapper.xml
+++ b/src/main/java/com/gxwebsoft/common/system/mapper/xml/UserMapper.xml
@@ -371,6 +371,8 @@
            a.tenant_id,
            a.username,
            a.avatar,
+           a.status,
+           a.password,
            a.create_time,
            t.tenant_name
     FROM sys_user a