diff --git a/backend/src/main/java/io/metersphere/commons/constants/PermissionConstants.java b/backend/src/main/java/io/metersphere/commons/constants/PermissionConstants.java
index 8d3b33e994..f6a63f84a3 100644
--- a/backend/src/main/java/io/metersphere/commons/constants/PermissionConstants.java
+++ b/backend/src/main/java/io/metersphere/commons/constants/PermissionConstants.java
@@ -38,6 +38,7 @@ public class PermissionConstants {
     public static final String SYSTEM_AUTH_READ = "SYSTEM_AUTH:READ";
     public static final String SYSTEM_AUTH_READ_EDIT = "SYSTEM_AUTH:READ+EDIT";
 
+    public static final String SYSTEM_OPERATING_LOG_READ = "SYSTEM_OPERATING_LOG:READ";
 
     public static final String WORKSPACE_SERVICE_READ = "WORKSPACE_SERVICE:READ";
     public static final String WORKSPACE_SERVICE_READ_EDIT = "WORKSPACE_SERVICE:READ+EDIT";
@@ -60,6 +61,7 @@ public class PermissionConstants {
     public static final String WORKSPACE_PROJECT_ENVIRONMENT_READ_IMPORT = "WORKSPACE_PROJECT_ENVIRONMENT:READ+IMPORT";
     public static final String WORKSPACE_PROJECT_ENVIRONMENT_READ_EXPORT = "WORKSPACE_PROJECT_ENVIRONMENT:READ+EXPORT";
 
+    public static final String WORKSPACE_OPERATING_LOG_READ = "WORKSPACE_OPERATING_LOG:READ";
 
     public static final String PROJECT_USER_READ = "PROJECT_USER:READ";
     public static final String PROJECT_USER_READ_CREATE = "PROJECT_USER:READ+CREATE";
@@ -85,6 +87,8 @@ public class PermissionConstants {
     public static final String PROJECT_ENVIRONMENT_READ_IMPORT = "PROJECT_ENVIRONMENT:READ+IMPORT";
     public static final String PROJECT_ENVIRONMENT_READ_EXPORT = "PROJECT_ENVIRONMENT:READ+EXPORT";
 
+    public static final String PROJECT_OPERATING_LOG_READ = "PROJECT_OPERATING_LOG:READ";
+
     public static final String PROJECT_TRACK_CASE_READ = "PROJECT_TRACK_CASE:READ";
     public static final String PROJECT_TRACK_CASE_READ_CREATE = "PROJECT_TRACK_CASE:READ+CREATE";
     public static final String PROJECT_TRACK_CASE_READ_EDIT = "PROJECT_TRACK_CASE:READ+EDIT";
diff --git a/backend/src/main/java/io/metersphere/controller/UserController.java b/backend/src/main/java/io/metersphere/controller/UserController.java
index 44d712d72b..b82c6c8627 100644
--- a/backend/src/main/java/io/metersphere/controller/UserController.java
+++ b/backend/src/main/java/io/metersphere/controller/UserController.java
@@ -5,6 +5,7 @@ import com.github.pagehelper.PageHelper;
 import io.metersphere.base.domain.User;
 import io.metersphere.commons.constants.OperLogConstants;
 import io.metersphere.commons.constants.OperLogModule;
+import io.metersphere.commons.constants.PermissionConstants;
 import io.metersphere.commons.exception.MSException;
 import io.metersphere.commons.utils.PageUtils;
 import io.metersphere.commons.utils.Pager;
@@ -18,6 +19,8 @@ import io.metersphere.i18n.Translator;
 import io.metersphere.log.annotation.MsAuditLog;
 import io.metersphere.service.UserService;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.shiro.authz.annotation.Logical;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
 
@@ -95,6 +98,12 @@ public class UserController {
     }
 
     @GetMapping("/list")
+    @RequiresPermissions(value = {
+            PermissionConstants.SYSTEM_WORKSPACE_READ_CREATE,
+            PermissionConstants.SYSTEM_GROUP_READ_CREATE,
+            PermissionConstants.WORKSPACE_USER_READ_CREATE,
+            PermissionConstants.SYSTEM_OPERATING_LOG_READ,
+    }, logical = Logical.OR)
     public List<User> getUserList() {
         return userService.getUserList();
     }
diff --git a/frontend/src/business/components/common/components/search/search-components.js b/frontend/src/business/components/common/components/search/search-components.js
index fc1089e9fc..ebf5d809bf 100644
--- a/frontend/src/business/components/common/components/search/search-components.js
+++ b/frontend/src/business/components/common/components/search/search-components.js
@@ -269,7 +269,7 @@ export const CREATOR = {
     }
   },
   options: { // 异步获取候选项
-    url: "/user/list",
+    url: "/user/ws/current/member/list",
     labelKey: "name",
     valueKey: "id",
     showLabel: option => {
@@ -297,7 +297,7 @@ export const EXECUTOR = {
     }
   },
   options: { // 异步获取候选项
-    url: "/user/list",
+    url: "/user/ws/current/member/list",
     labelKey: "name",
     valueKey: "id",
     showLabel: option => {
@@ -420,7 +420,7 @@ export const PRINCIPAL = {
     }
   },
   options: { // 异步获取候选项
-    url: "/user/list",
+    url: "/user/ws/current/member/list",
     labelKey: "name",
     valueKey: "id",
     showLabel: option => {
@@ -448,7 +448,7 @@ export const PRINCIPALAPI = {
     }
   },
   options: { // 异步获取候选项
-    url: "/user/list",
+    url: "/user/ws/current/member/list",
     labelKey: "name",
     valueKey: "id",
     showLabel: option => {
diff --git a/frontend/src/business/components/notice/Notification.vue b/frontend/src/business/components/notice/Notification.vue
index 3dbc08c181..b8caf7b4aa 100644
--- a/frontend/src/business/components/notice/Notification.vue
+++ b/frontend/src/business/components/notice/Notification.vue
@@ -95,7 +95,7 @@ export default {
   },
   methods: {
     getUserList() {
-      this.$get('/user/list', response => {
+      this.$get('/user/ws/current/member/list', response => {
         this.userList = response.data;
         this.userMap = this.userList.reduce((r, c) => {
           r[c.id] = c;
diff --git a/frontend/src/business/components/project/menu/Log.vue b/frontend/src/business/components/project/menu/Log.vue
index 46f4e2f0f6..c1f03022ef 100644
--- a/frontend/src/business/components/project/menu/Log.vue
+++ b/frontend/src/business/components/project/menu/Log.vue
@@ -225,7 +225,7 @@ export default {
       this.$set(this.condition, "operUser", item.id);
     },
     getMember() {
-      this.result = this.$get('/user/list/', response => {
+      this.result = this.$get('/user/ws/current/member/list', response => {
         this.userList = response.data;
       });
     },
diff --git a/frontend/src/business/components/settings/operatinglog/OperatingLog.vue b/frontend/src/business/components/settings/operatinglog/OperatingLog.vue
index e11919ecca..16c3087f58 100644
--- a/frontend/src/business/components/settings/operatinglog/OperatingLog.vue
+++ b/frontend/src/business/components/settings/operatinglog/OperatingLog.vue
@@ -181,17 +181,9 @@ export default {
           this.getWorkSpaceList();
           this.getMember();
           break;
-        case "organization":
-          this.initProject("/project/listAll/" + getCurrentWorkspaceId());
-          this.getMember();
-          break;
         case "workspace":
           this.initProject("/project/listAll/" + getCurrentWorkspaceId());
-          this.getMember();
-          break;
-        case "project":
-          this.getProject();
-          this.getMember();
+          this.getMember('/user/ws/current/member/list');
           break;
       }
     },
@@ -202,17 +194,9 @@ export default {
             this.getWorkSpaceList();
             this.getMember();
             break;
-          case "organization":
-            this.initProject("/project/listAll/" + getCurrentWorkspaceId());
-            this.getMember();
-            break;
           case "workspace":
             this.initProject("/project/listAll/" + getCurrentWorkspaceId());
-            this.getMember();
-            break;
-          case "project":
-            this.getProject();
-            this.getMember();
+            this.getMember('/user/ws/current/member/list');
             break;
         }
       },
@@ -278,8 +262,11 @@ export default {
       handleSelect(item) {
         this.$set(this.condition, "operUser", item.id);
       },
-      getMember() {
-        this.result = this.$get('/user/list/', response => {
+      getMember(url) {
+        if (!url) {
+          url = '/usr/list';
+        }
+        this.result = this.$get(url, response => {
           this.userList = response.data;
         });
       },