diff --git a/cf-module-prod-executor/cf-module-prod-executor-biz/src/main/java/com/cf/imes/module/executor/controller/admin/order/OrderSupStatisticsController.java b/cf-module-prod-executor/cf-module-prod-executor-biz/src/main/java/com/cf/imes/module/executor/controller/admin/order/OrderSupStatisticsController.java
index fbfab7c49..1ec1ebf81 100644
--- a/cf-module-prod-executor/cf-module-prod-executor-biz/src/main/java/com/cf/imes/module/executor/controller/admin/order/OrderSupStatisticsController.java
+++ b/cf-module-prod-executor/cf-module-prod-executor-biz/src/main/java/com/cf/imes/module/executor/controller/admin/order/OrderSupStatisticsController.java
@@ -9,6 +9,7 @@ import com.cf.imes.module.system.api.user.AdminUserApi;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -39,24 +40,28 @@ public class OrderSupStatisticsController {
 
     @GetMapping("/total/org")
     @Operation(summary = "组织总数")
+    @PreAuthorize("@ss.hasPermission('homePage:analysis:org-statistic')")
     public CommonResult<Map<String, Integer>> getOrgTotal() {
         return success(organApi.getOrgTotal().getData());
     }
 
     @GetMapping("/total/user")
     @Operation(summary = "用户总数")
+    @PreAuthorize("@ss.hasPermission('homePage:analysis:org-statistic')")
     public CommonResult<Map<String, Integer>> getUserTotal() {
         return success(adminUserApi.getUserTotal().getData());
     }
 
     @GetMapping("/total/userAct")
     @Operation(summary = "用户活跃数")
+    @PreAuthorize("@ss.hasPermission('homePage:analysis:org-statistic')")
     public CommonResult<Map<String, Integer>> getUserActTotal() {
         return success(adminUserApi.getUserActTotal().getData());
     }
 
     @GetMapping("/total/order")
     @Operation(summary = "生产单总数")
+    @PreAuthorize("@ss.hasPermission('homePage:analysis:org-statistic')")
     public CommonResult<Map<String, Integer>> getOrderTotal() {
         return success(orderSupStatisticsService.orderTotal());
     }
@@ -69,12 +74,14 @@ public class OrderSupStatisticsController {
 
     @GetMapping("/separate/order")
     @Operation(summary = "有效、无效生产单数量统计")
+    @PreAuthorize("@ss.hasPermission('homePage:analysis:order-count')")
     public CommonResult<Map<String, Object>> getOrderSeparate(@Valid OrderStatisticsReqVO reqVO) {
         return success(orderSupStatisticsService.orderSeparate(reqVO));
     }
 
     @GetMapping("/separate/org")
     @Operation(summary = "新增、注销组织数量统计")
+    @PreAuthorize("@ss.hasPermission('homePage:analysis:org-count')")
     public CommonResult<Map<String, Object>> getOrgSeparate(@Valid OrgStatisticsReqDTO reqVO) {
         return organApi.getOrgSeparate(reqVO);
     }
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/user/AdminUserMapper.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/user/AdminUserMapper.java
index 5d0a57bea..e2dd039ed 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/user/AdminUserMapper.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/user/AdminUserMapper.java
@@ -72,7 +72,11 @@ public interface AdminUserMapper extends BaseMapperX<AdminUserDO> {
         assert loginUser != null;
         if (SecurityFrameworkUtils.isCfOrg()) {
             if (!Objects.isNull(reqVO.getOrganId())) {
+                // 管理端晨丰组织看全部组织下的
                 lambdaQueryWrapperX.eqIfPresent(AdminUserDO::getOrganId, reqVO.getOrganId());
+            } else if(!SecurityFrameworkUtils.isManageEndPoint()){
+                // 生产端晨丰组织只看晨丰组织下的
+                lambdaQueryWrapperX.eqIfPresent(AdminUserDO::getOrganId, loginUser.getOrganId());
             }
         } else {
             lambdaQueryWrapperX.eqIfPresent(AdminUserDO::getOrganId, loginUser.getOrganId());
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/validation/menu/MenuSourceTypeValid.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/validation/menu/MenuSourceTypeValid.java
index c01f00716..33cb5916f 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/validation/menu/MenuSourceTypeValid.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/validation/menu/MenuSourceTypeValid.java
@@ -25,7 +25,7 @@ import java.lang.annotation.Target;
         validatedBy = {MenuSourceTypeValidator.class}
 )
 public @interface MenuSourceTypeValid {
-    String message() default "菜单类型不合法";
+    String message() default "菜单来源类型不合法";
 
     Class<?>[] groups() default {};