diff --git a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java
index 40ea5f8d..7faaa74d 100644
--- a/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java
+++ b/laws-modules/src/main/java/com/jero/modules/laws/dataCenter/service/impl/LawsDataCenterFolderServiceImpl.java
@@ -204,6 +204,35 @@ public class LawsDataCenterFolderServiceImpl extends ServiceImpl<LawsDataCenterF
 	 */
 	@Override
     public void add(LawsDataCenterFolder lawsDataCenterFolder) {
+		// 水平越权
+		LoginUser loginUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
+		String roleIds = loginUser.getRoleIds();
+		List<String> adminRoleCodeList = Arrays.asList(adminRoleCode.split(","));
+		Collection<String> intersection = CollectionUtils.intersection(Arrays.asList(roleIds.split(",")), adminRoleCodeList);
+		if (!roleIds.contains("admin") && CollectionUtils.isEmpty(intersection)){
+			LambdaQueryWrapper<LawsDataCenterFolderSublist> queryWrapper = new LambdaQueryWrapper<>();
+			if ("0".equals(lawsDataCenterFolder.getParentId())) {
+				List<LawsDataCenterFolder> firstList = list(
+						new LambdaQueryWrapper<LawsDataCenterFolder>()
+								.eq(LawsDataCenterFolder::getParentId, "0"));
+				if (CollectionUtils.isNotEmpty(firstList)){
+					queryWrapper.in(LawsDataCenterFolderSublist::getDataCenterFolderId,
+							firstList.stream().map(LawsDataCenterFolder::getId).collect(Collectors.toList()));
+				}
+			}else {
+				queryWrapper.eq(LawsDataCenterFolderSublist::getDataCenterFolderId, lawsDataCenterFolder.getParentId());
+			}
+			queryWrapper.eq(LawsDataCenterFolderSublist::getType, DataCenterCommon.AUTH_MANAGE);
+			queryWrapper.like(LawsDataCenterFolderSublist::getUserId, loginUser.getId());
+			int count = lawsDataCenterFolderSublistService.count(queryWrapper);
+			if (count == 0){
+				if(LanguageEnum.CN.equals(MessageUtils.getLanguage())) {
+					throw new JeroBootException("无权限!");
+				}else{
+					throw new JeroBootException("No access!");
+				}
+			}
+		}
 		lawsDataCenterFolder.setOwnerId(CurrentUserUtil.getId());
 		lawsDataCenterFolder.setOrgCode(CurrentUserUtil.getOrgCode());
 		if (StringUtils.isBlank(lawsDataCenterFolder.getParentId())) {