diff --git a/backend/services/bug-management/src/main/java/io/metersphere/bug/controller/BugAttachmentController.java b/backend/services/bug-management/src/main/java/io/metersphere/bug/controller/BugAttachmentController.java
index aa980027b4..17e295c6a6 100644
--- a/backend/services/bug-management/src/main/java/io/metersphere/bug/controller/BugAttachmentController.java
+++ b/backend/services/bug-management/src/main/java/io/metersphere/bug/controller/BugAttachmentController.java
@@ -138,10 +138,9 @@ public class BugAttachmentController {
         return bugAttachmentService.upgrade(request, SessionUtils.getUserId());
     }
 
-    // 富文本相关接口
     @PostMapping("/upload/md/file")
     @Operation(summary = "缺陷管理-富文本附件-上传")
-    @RequiresPermissions(logical = Logical.OR, value = {PermissionConstants.PROJECT_BUG_ADD, PermissionConstants.PROJECT_BUG_UPDATE})
+    @RequiresPermissions(logical = Logical.OR, value = {PermissionConstants.PROJECT_BUG_ADD, PermissionConstants.PROJECT_BUG_UPDATE, PermissionConstants.PROJECT_BUG_COMMENT})
     public String upload(@RequestParam("file") MultipartFile file) throws Exception {
         return bugAttachmentService.uploadMdFile(file);
     }
diff --git a/frontend/src/api/requrls/bug-management.ts b/frontend/src/api/requrls/bug-management.ts
index 6406595e80..543bb16ce9 100644
--- a/frontend/src/api/requrls/bug-management.ts
+++ b/frontend/src/api/requrls/bug-management.ts
@@ -47,7 +47,7 @@ export const deleteFileOrCancelAssociationUrl = '/bug/attachment/delete';
 // 获取附件列表
 export const getAttachmentListUrl = '/bug/attachment/list/';
 // 富文本编辑器上传图片
-export const editorUploadFileUrl = '/attachment/upload/temp/file';
+export const editorUploadFileUrl = '/bug/attachment/upload/md/file';
 
 // 获取回收站列表
 export const getRecycleListUrl = '/bug/trash/page';
diff --git a/frontend/src/views/bug-management/index.vue b/frontend/src/views/bug-management/index.vue
index ae51a48474..4d9ad38bf6 100644
--- a/frontend/src/views/bug-management/index.vue
+++ b/frontend/src/views/bug-management/index.vue
@@ -15,7 +15,12 @@
             <a-button v-permission="['PROJECT_BUG:READ+ADD']" type="primary" @click="handleCreate"
               >{{ t('bugManagement.createBug') }}
             </a-button>
-            <a-button v-if="currentPlatform !== 'Local'" :loading="!isComplete" type="outline" @click="handleSync"
+            <a-button
+              v-if="currentPlatform !== 'Local'"
+              v-permission="['PROJECT_BUG:READ+ADD']"
+              :loading="!isComplete"
+              type="outline"
+              @click="handleSync"
               >{{ t('bugManagement.syncBug') }}
             </a-button>
           </div>