diff --git a/backend/src/main/java/io/metersphere/controller/GroupController.java b/backend/src/main/java/io/metersphere/controller/GroupController.java
index 7cb4e58439..86c9c07f05 100644
--- a/backend/src/main/java/io/metersphere/controller/GroupController.java
+++ b/backend/src/main/java/io/metersphere/controller/GroupController.java
@@ -157,6 +157,7 @@ public class GroupController {
     }
 
     @PostMapping("/add/member")
+    @RequiresPermissions(value = {PermissionConstants.SYSTEM_GROUP_READ_CREATE, PermissionConstants.PROJECT_GROUP_READ_CREATE}, logical = Logical.OR)
     public void addGroupUser(@RequestBody EditGroupUserRequest request) {
         groupService.addGroupUser(request);
     }