diff --git a/src/test/java/com/gxwebsoft/approval/ApprovalCoordinationIT.java b/src/test/java/com/gxwebsoft/approval/ApprovalCoordinationIT.java
index 4ffdf2a..867c788 100644
--- a/src/test/java/com/gxwebsoft/approval/ApprovalCoordinationIT.java
+++ b/src/test/java/com/gxwebsoft/approval/ApprovalCoordinationIT.java
@@ -129,6 +129,23 @@ class ApprovalCoordinationIT {
       .contains("confirm").contains("archive");
     assertThat(data.countMaster("SELECT COUNT(*) FROM approval_flow_definition "
       + "WHERE tenant_id = ? AND flow_code = 'coordination_external'", TENANT)).isZero();
+
+    // 报送部门与经办人只取登录态，客户端伪造字段被忽略
+    ApprovalTestData.TestUser other = data.createUser("他人" + data.uniqueSuffix(), acceptOrgId);
+    String forged = "{\"acceptOrgId\":" + acceptOrgId + ",\"title\":\"伪造部门\",\"content\":\"内容\","
+      + "\"reporterId\":" + other.userId + ",\"reportOrgId\":" + acceptOrgId + "}";
+    String forgedResponse = mockMvc.perform(authed(post("/api/approval/instance/coordination"),
+        reporter, reportOrgId, SUBMIT)
+        .contentType(MediaType.APPLICATION_JSON)
+        .content(forged))
+      .andExpect(jsonPath("$.code").value(0))
+      .andReturn().getResponse().getContentAsString(StandardCharsets.UTF_8);
+    long forgedId = objectMapper.readTree(forgedResponse).path("data").asLong();
+    data.trackInstance(forgedId);
+    assertThat(data.queryMaster("SELECT reporter_id FROM approval_instance WHERE id = ?",
+      Integer.class, forgedId)).isEqualTo(reporter.userId);
+    assertThat(data.queryMaster("SELECT report_org_id FROM approval_instance WHERE id = ?",
+      Integer.class, forgedId)).isEqualTo(reportOrgId);
   }
 
   @Test