diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java
index 3b6b403c0..9be92ad4f 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java
@@ -23,6 +23,7 @@ import javax.validation.Valid;
 import java.util.List;
 import java.util.Objects;
 import java.util.Set;
+import java.util.stream.Collectors;
 
 import static com.cf.imes.framework.common.pojo.CommonResult.success;
 import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID;
@@ -57,7 +58,7 @@ public class PermissionController {
     public CommonResult<Boolean> assignRoleMenu(@Validated @RequestBody PermissionAssignRoleMenuReqVO reqVO) {
         LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
         if(!loginUser.getIsSupAdmin() && ( Objects.equals(reqVO.getRoleId(), ORGAN_ADMIN_ROLE_ID) || Objects.equals(reqVO.getRoleId(), ORGAN_STAFF_ROLE_ID))) {
-            throw new ServiceException(11541, "内置角色无法修改");
+            throw new ServiceException(11541, "内置角色无权修改");
         }
         if(Objects.equals(reqVO.getRoleId(), ORGAN_ADMIN_ROLE_ID) || Objects.equals(reqVO.getRoleId(), ORGAN_STAFF_ROLE_ID)) {
         } else {
@@ -97,6 +98,12 @@ public class PermissionController {
     @PostMapping("/bath-assign-user-role")
     @PreAuthorize("@ss.hasPermission('system:permission:assign-user-role')")
     public CommonResult<Boolean> bathAssignUserRole(@Validated @RequestBody List<PermissionAssignUserRoleReqVO> listReqVO) {
+        Set<Long> roleIds = listReqVO.stream().flatMap(e -> e.getRoleIds().stream()).collect(Collectors.toSet());
+        if(!SecurityFrameworkUtils.getLoginUser().getIsSupAdmin()) {
+            if(roleIds.contains(ORGAN_ADMIN_ROLE_ID) || roleIds.contains(ORGAN_STAFF_ROLE_ID)) {
+                throw new ServiceException(11541, "内置角色无权修改");
+            }
+        }
         permissionService.bathAssignUserRole(listReqVO);
         return success(true);
     }