diff --git a/src/main/java/com/gxwebsoft/cms/controller/CmsBannerController.java b/src/main/java/com/gxwebsoft/cms/controller/CmsBannerController.java
index d75424a..b48ac68 100644
--- a/src/main/java/com/gxwebsoft/cms/controller/CmsBannerController.java
+++ b/src/main/java/com/gxwebsoft/cms/controller/CmsBannerController.java
@@ -8,6 +8,7 @@ import com.gxwebsoft.common.core.web.BaseController;
 import com.gxwebsoft.common.core.web.PageResult;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import javax.annotation.Resource;
@@ -46,6 +47,7 @@ public class CmsBannerController extends BaseController {
     }
 
     @Operation(summary = "添加轮播图")
+    @PreAuthorize("hasAuthority('cms:cmsBanner:save')")
     @PostMapping()
     public ApiResult<?> save(@RequestBody CmsBanner cmsBanner) {
         if (cmsBannerService.save(cmsBanner)) {
@@ -55,6 +57,7 @@ public class CmsBannerController extends BaseController {
     }
 
     @Operation(summary = "修改轮播图")
+    @PreAuthorize("hasAuthority('cms:cmsBanner:update')")
     @PutMapping()
     public ApiResult<?> update(@RequestBody CmsBanner cmsBanner) {
         if (cmsBannerService.updateById(cmsBanner)) {
@@ -64,6 +67,7 @@ public class CmsBannerController extends BaseController {
     }
 
     @Operation(summary = "删除轮播图")
+    @PreAuthorize("hasAuthority('cms:cmsBanner:remove')")
     @DeleteMapping("/{id}")
     public ApiResult<?> remove(@PathVariable("id") Integer id) {
         if (cmsBannerService.removeById(id)) {
@@ -73,6 +77,7 @@ public class CmsBannerController extends BaseController {
     }
 
     @Operation(summary = "修改轮播图状态(启用/停用)")
+    @PreAuthorize("hasAuthority('cms:cmsBanner:update')")
     @PutMapping("/status")
     public ApiResult<?> updateStatus(@RequestBody CmsBanner cmsBanner) {
         CmsBanner entity = new CmsBanner();
diff --git a/src/main/java/com/gxwebsoft/cms/controller/CmsBannerGroupController.java b/src/main/java/com/gxwebsoft/cms/controller/CmsBannerGroupController.java
index 6be1cc8..242c872 100644
--- a/src/main/java/com/gxwebsoft/cms/controller/CmsBannerGroupController.java
+++ b/src/main/java/com/gxwebsoft/cms/controller/CmsBannerGroupController.java
@@ -10,6 +10,7 @@ import com.gxwebsoft.common.core.web.BaseController;
 import com.gxwebsoft.common.core.web.PageResult;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import javax.annotation.Resource;
@@ -55,6 +56,7 @@ public class CmsBannerGroupController extends BaseController {
     }
 
     @Operation(summary = "添加轮播组(可携带items一次性创建)")
+    @PreAuthorize("hasAuthority('cms:cmsBannerGroup:save')")
     @PostMapping()
     public ApiResult<?> save(@RequestBody CmsBannerGroup group) {
         if (cmsBannerGroupService.saveGroup(group)) {
@@ -64,6 +66,7 @@ public class CmsBannerGroupController extends BaseController {
     }
 
     @Operation(summary = "修改轮播组(可携带items一次性全量替换)")
+    @PreAuthorize("hasAuthority('cms:cmsBannerGroup:update')")
     @PutMapping()
     public ApiResult<?> update(@RequestBody CmsBannerGroup group) {
         if (group.getGroupId() == null) {
@@ -76,6 +79,7 @@ public class CmsBannerGroupController extends BaseController {
     }
 
     @Operation(summary = "删除轮播组(连带删除组内items)")
+    @PreAuthorize("hasAuthority('cms:cmsBannerGroup:remove')")
     @DeleteMapping("/{groupId}")
     public ApiResult<?> remove(@PathVariable("groupId") Integer groupId) {
         if (cmsBannerGroupService.removeGroup(groupId)) {
@@ -85,6 +89,7 @@ public class CmsBannerGroupController extends BaseController {
     }
 
     @Operation(summary = "修改轮播组状态(启用/停用)")
+    @PreAuthorize("hasAuthority('cms:cmsBannerGroup:update')")
     @PutMapping("/status")
     public ApiResult<?> updateStatus(@RequestBody CmsBannerGroup group) {
         CmsBannerGroup entity = new CmsBannerGroup();
@@ -99,6 +104,7 @@ public class CmsBannerGroupController extends BaseController {
     // ---------------- 单项 CRUD（可选，保存组时已全量提交items，以下接口用于单独维护） ----------------
 
     @Operation(summary = "单独新增轮播项")
+    @PreAuthorize("hasAuthority('cms:cmsBannerGroup:save')")
     @PostMapping("/{groupId}/item")
     public ApiResult<?> addItem(@PathVariable("groupId") Integer groupId,
                                 @RequestBody CmsBannerItem item) {
@@ -117,6 +123,7 @@ public class CmsBannerGroupController extends BaseController {
     }
 
     @Operation(summary = "单独修改轮播项")
+    @PreAuthorize("hasAuthority('cms:cmsBannerGroup:update')")
     @PutMapping("/item")
     public ApiResult<?> updateItem(@RequestBody CmsBannerItem item) {
         if (item.getItemId() == null) {
@@ -129,6 +136,7 @@ public class CmsBannerGroupController extends BaseController {
     }
 
     @Operation(summary = "单独删除轮播项")
+    @PreAuthorize("hasAuthority('cms:cmsBannerGroup:remove')")
     @DeleteMapping("/item/{itemId}")
     public ApiResult<?> removeItem(@PathVariable("itemId") Integer itemId) {
         if (bannerItemDelete(itemId)) {
diff --git a/src/main/java/com/gxwebsoft/cms/controller/CmsCaseController.java b/src/main/java/com/gxwebsoft/cms/controller/CmsCaseController.java
index 8e2752e..9277a96 100644
--- a/src/main/java/com/gxwebsoft/cms/controller/CmsCaseController.java
+++ b/src/main/java/com/gxwebsoft/cms/controller/CmsCaseController.java
@@ -10,6 +10,7 @@ import com.gxwebsoft.common.core.web.PageResult;
 import com.gxwebsoft.common.system.entity.User;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import javax.annotation.Resource;
@@ -48,6 +49,7 @@ public class CmsCaseController extends BaseController {
     }
 
     @Operation(summary = "添加客户案例")
+    @PreAuthorize("hasAuthority('cms:cmsCase:save')")
     @PostMapping()
     public ApiResult<?> save(@RequestBody CmsCase cmsCase) {
         if (cmsCaseService.save(cmsCase)) {
@@ -57,6 +59,7 @@ public class CmsCaseController extends BaseController {
     }
 
     @Operation(summary = "修改客户案例")
+    @PreAuthorize("hasAuthority('cms:cmsCase:update')")
     @PutMapping()
     public ApiResult<?> update(@RequestBody CmsCase cmsCase) {
         if (cmsCaseService.updateById(cmsCase)) {
@@ -66,6 +69,7 @@ public class CmsCaseController extends BaseController {
     }
 
     @Operation(summary = "删除客户案例")
+    @PreAuthorize("hasAuthority('cms:cmsCase:remove')")
     @DeleteMapping("/{id}")
     public ApiResult<?> remove(@PathVariable("id") Integer id) {
         if (cmsCaseService.removeById(id)) {
@@ -75,6 +79,7 @@ public class CmsCaseController extends BaseController {
     }
 
     @Operation(summary = "修改案例状态(发布/下线)")
+    @PreAuthorize("hasAuthority('cms:cmsCase:update')")
     @PutMapping("/status")
     public ApiResult<?> updateStatus(@RequestBody CmsCase cmsCase) {
         CmsCase entity = new CmsCase();
diff --git a/src/main/java/com/gxwebsoft/cms/controller/CmsPageController.java b/src/main/java/com/gxwebsoft/cms/controller/CmsPageController.java
index 59ae631..f304914 100644
--- a/src/main/java/com/gxwebsoft/cms/controller/CmsPageController.java
+++ b/src/main/java/com/gxwebsoft/cms/controller/CmsPageController.java
@@ -11,6 +11,7 @@ import com.gxwebsoft.common.core.web.ApiResult;
 import com.gxwebsoft.common.core.web.PageResult;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import javax.annotation.Resource;
@@ -62,6 +63,7 @@ public class CmsPageController extends BaseController {
     }
 
     @Operation(summary = "添加单页")
+    @PreAuthorize("hasAuthority('cms:cmsPage:save')")
     @PostMapping()
     public ApiResult<?> save(@RequestBody CmsPage page) {
         User loginUser = getLoginUser();
@@ -83,6 +85,7 @@ public class CmsPageController extends BaseController {
     }
 
     @Operation(summary = "修改单页")
+    @PreAuthorize("hasAuthority('cms:cmsPage:update')")
     @PutMapping()
     public ApiResult<?> update(@RequestBody CmsPage page) {
         if (page.getPageId() == null) {
@@ -98,6 +101,7 @@ public class CmsPageController extends BaseController {
     }
 
     @Operation(summary = "删除单页")
+    @PreAuthorize("hasAuthority('cms:cmsPage:remove')")
     @DeleteMapping("/{id}")
     public ApiResult<?> remove(@PathVariable("id") Integer id) {
         if (cmsPageService.removeById(id)) {
@@ -107,6 +111,7 @@ public class CmsPageController extends BaseController {
     }
 
     @Operation(summary = "修改单页状态(草稿/发布/下线)")
+    @PreAuthorize("hasAuthority('cms:cmsPage:update')")
     @PutMapping("/status")
     public ApiResult<?> updateStatus(@RequestBody Map<String, Object> body) {
         Object idObj = body.get("pageId");
diff --git a/src/main/java/com/gxwebsoft/cms/controller/CmsProductController.java b/src/main/java/com/gxwebsoft/cms/controller/CmsProductController.java
index 1992d85..3860500 100644
--- a/src/main/java/com/gxwebsoft/cms/controller/CmsProductController.java
+++ b/src/main/java/com/gxwebsoft/cms/controller/CmsProductController.java
@@ -9,6 +9,7 @@ import com.gxwebsoft.common.core.web.PageResult;
 import com.gxwebsoft.common.system.entity.User;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import javax.annotation.Resource;
@@ -47,6 +48,7 @@ public class CmsProductController extends BaseController {
     }
 
     @Operation(summary = "添加产品")
+    @PreAuthorize("hasAuthority('cms:cmsProduct:save')")
     @PostMapping()
     public ApiResult<?> save(@RequestBody CmsProduct cmsProduct) {
         User loginUser = getLoginUser();
@@ -60,6 +62,7 @@ public class CmsProductController extends BaseController {
     }
 
     @Operation(summary = "修改产品")
+    @PreAuthorize("hasAuthority('cms:cmsProduct:update')")
     @PutMapping()
     public ApiResult<?> update(@RequestBody CmsProduct cmsProduct) {
         if (cmsProductService.updateById(cmsProduct)) {
@@ -69,6 +72,7 @@ public class CmsProductController extends BaseController {
     }
 
     @Operation(summary = "删除产品")
+    @PreAuthorize("hasAuthority('cms:cmsProduct:remove')")
     @DeleteMapping("/{id}")
     public ApiResult<?> remove(@PathVariable("id") Integer id) {
         if (cmsProductService.removeById(id)) {
@@ -78,6 +82,7 @@ public class CmsProductController extends BaseController {
     }
 
     @Operation(summary = "修改产品状态(在售/下架)")
+    @PreAuthorize("hasAuthority('cms:cmsProduct:update')")
     @PutMapping("/status")
     public ApiResult<?> updateStatus(@RequestBody CmsProduct cmsProduct) {
         CmsProduct entity = new CmsProduct();