diff --git a/src/main/java/com/budwk/app/zhgh/democratic/proposal/controller/query/ProposalQueryUnitReplyController.java b/src/main/java/com/budwk/app/zhgh/democratic/proposal/controller/query/ProposalQueryUnitReplyController.java
index b6f716ca..7cf5665b 100644
--- a/src/main/java/com/budwk/app/zhgh/democratic/proposal/controller/query/ProposalQueryUnitReplyController.java
+++ b/src/main/java/com/budwk/app/zhgh/democratic/proposal/controller/query/ProposalQueryUnitReplyController.java
@@ -2,14 +2,21 @@ package com.budwk.app.zhgh.democratic.proposal.controller.query;
 
 import cn.hutool.core.bean.BeanUtil;
 import cn.dev33.satoken.annotation.SaCheckPermission;
+import com.budwk.app.base.constant.RoleConstant;
 import com.budwk.app.base.page.Pagination;
 import com.budwk.app.base.result.Result;
 import com.budwk.app.flow.engine.util.FlowUtil;
 import com.budwk.app.flow.entity.ProcessTask;
 import com.budwk.app.flow.enums.ProcessTaskStateEnum;
+import com.budwk.app.sys.models.Sys_role;
+import com.budwk.app.sys.models.Sys_user_role;
+import com.budwk.app.sys.services.SysRoleService;
+import com.budwk.app.web.commons.auth.utils.AuthUtil;
+import com.budwk.app.web.commons.auth.utils.SecurityUtil;
 import com.budwk.app.zhgh.democratic.proposal.controller.vo.ProposalUnitReplyProposalVO;
 import com.budwk.app.zhgh.democratic.proposal.models.ProposalConfig;
 import com.budwk.app.zhgh.democratic.proposal.models.ProposalReplyUnit;
+import com.budwk.app.zhgh.democratic.proposal.models.ProposalUndertake;
 import com.budwk.app.zhgh.democratic.proposal.param.ProposalSearchParam;
 import com.budwk.app.zhgh.democratic.proposal.service.common.ProposalCommonService;
 import io.swagger.annotations.ApiOperation;
@@ -40,6 +47,8 @@ public class ProposalQueryUnitReplyController {
     private Dao dao;
     @Inject
     private ProposalCommonService proposalCommonService;
+    @Inject
+    private SysRoleService sysRoleService;
 
     @At("")
     @Ok("beetl:/platform/zhgh/democratic/proposal/query/underTakeReply/index.html")
@@ -54,6 +63,19 @@ public class ProposalQueryUnitReplyController {
         // 提案配置 协办是否需要答复
         ProposalConfig proposalConfig = dao.fetch(ProposalConfig.class, Cnd.NEW());
         boolean slaveNeedReply = proposalConfig.getSlaveUnitNeedReply();
+        boolean proposalAdmin = isProposalAdmin();
+
+        if (!proposalAdmin) {
+            List<ProposalUndertake> manageUndertakes = getManageUndertakes();
+            List<String> manageUndertakeIds = manageUndertakes.stream().map(ProposalUndertake::getId).toList();
+            if (manageUndertakeIds.isEmpty()) {
+                return Result.success().addData(Map.of("tableData", Collections.EMPTY_LIST, "slaveNeedReply", slaveNeedReply));
+            }
+            // 非超级管理员、提案管理员时，统计范围固定为当前用户角色绑定的承办单位，避免前端传其他单位越权查询。
+            if (undertakeUnitId != null && !undertakeUnitId.isBlank() && !manageUndertakeIds.contains(undertakeUnitId)) {
+                return Result.success().addData(Map.of("tableData", Collections.EMPTY_LIST, "slaveNeedReply", slaveNeedReply));
+            }
+        }
 
         // 当前届次所有的提案ID
         Sql sql = Sqls.create("select id from proposal_info where sessionId = @sessionId").setParam("sessionId", sessionId);
@@ -75,7 +97,16 @@ public class ProposalQueryUnitReplyController {
 
         // 提案委员会立案分配的承办单位
         Cnd cnd = Cnd.where(ProposalReplyUnit::getProposalId, "in", proposalIds);
-        cnd.andEX(ProposalReplyUnit::getUnitId, "=", undertakeUnitId);
+        if (proposalAdmin) {
+            cnd.andEX(ProposalReplyUnit::getUnitId, "=", undertakeUnitId);
+        } else {
+            List<String> manageUndertakeIds = getManageUndertakes().stream().map(ProposalUndertake::getId).toList();
+            if (undertakeUnitId != null && !undertakeUnitId.isBlank()) {
+                cnd.and(ProposalReplyUnit::getUnitId, "=", undertakeUnitId);
+            } else {
+                cnd.and(ProposalReplyUnit::getUnitId, "in", manageUndertakeIds);
+            }
+        }
         List<ProposalReplyUnit> replyUnits = dao.query(ProposalReplyUnit.class, cnd);
 
         // 承办单位答复记录
@@ -142,6 +173,14 @@ public class ProposalQueryUnitReplyController {
     @SaCheckPermission("proposal.query.unitReply")
     @ApiOperation("承办单位提案明细")
     public Result getProposalsByUnit(@Valid ProposalSearchParam pageForm, String unitCode) {
+        if (!isProposalAdmin()) {
+            List<ProposalUndertake> manageUndertakes = getManageUndertakes();
+            List<String> manageUnitCodes = manageUndertakes.stream().map(ProposalUndertake::getCode).toList();
+            if (manageUnitCodes.isEmpty() || !manageUnitCodes.contains(unitCode)) {
+                return Result.success(new Pagination(pageForm.getPageNumber(), pageForm.getPageSize(), 0, Collections.emptyList()));
+            }
+        }
+
         Sql sql = Sqls.create("""
                 SELECT
                     info.id,
@@ -167,6 +206,10 @@ public class ProposalQueryUnitReplyController {
         Cnd cnd = Cnd.NEW();
         // 明细弹窗按当前届次和点击的承办单位编码查询，返回该单位主办、协办的提案列表。
         cnd.andEX("pru.unitCode", "=", unitCode);
+        if (!isProposalAdmin()) {
+            List<String> manageUndertakeIds = getManageUndertakes().stream().map(ProposalUndertake::getId).toList();
+            cnd.and("pru.unitId", "in", manageUndertakeIds);
+        }
         ProposalSearchParam.buildSearch(cnd, pageForm);
         cnd.groupBy("info.id", "pru.unitName", "pru.isMaster");
         sql.setCondition(cnd);
@@ -176,4 +219,45 @@ public class ProposalQueryUnitReplyController {
         pagination.setList(list);
         return Result.success(pagination);
     }
+
+    /**
+     * 判断当前用户是否拥有本页面全量统计权限。
+     *
+     * 角色说明：
+     * 1. SYSADMIN 为超级管理员，可查看全部承办单位。
+     * 2. SCHOOL_UNION_PROPOSAL_ADMIN 为校工会提案管理员，可查看全部承办单位。
+     * 3. 其他用户只能查看自己角色绑定的承办单位。
+     *
+     * @return boolean，true 表示可查看全部承办单位，false 表示需要限制到当前用户分管承办单位。
+     */
+    private boolean isProposalAdmin() {
+        return AuthUtil.hasRoleOr(RoleConstant.SYSADMIN.name(), RoleConstant.SCHOOL_UNION_PROPOSAL_ADMIN.name());
+    }
+
+    /**
+     * 获取当前用户角色绑定的提案承办单位。
+     *
+     * 参数：无参数，方法内部根据当前登录用户和 PROPOSAL_UNIT_LEADER 角色查询 sys_user_role.underTakeId。
+     * 处理逻辑：用户角色表中的 underTakeId 表示该用户负责的提案承办单位，不按教代会届次过滤。
+     * 返回值：List<ProposalUndertake>，表示当前用户角色绑定的承办单位列表；没有配置时返回空列表。
+     */
+    private List<ProposalUndertake> getManageUndertakes() {
+        Sys_role role = sysRoleService.getByCode(RoleConstant.PROPOSAL_UNIT_LEADER.name());
+        if (role == null) {
+            return Collections.emptyList();
+        }
+        List<Sys_user_role> userRoles = dao.query(Sys_user_role.class, Cnd.where(Sys_user_role::getRoleId, "=", role.getId())
+                .and(Sys_user_role::getUserId, "=", SecurityUtil.getUserId())
+                .and(Sys_user_role::getUnderTakeId, "is not", null));
+        List<String> undertakeIds = userRoles.stream()
+                .map(Sys_user_role::getUnderTakeId)
+                .filter(Objects::nonNull)
+                .filter(id -> !id.isBlank())
+                .distinct()
+                .toList();
+        if (undertakeIds.isEmpty()) {
+            return Collections.emptyList();
+        }
+        return dao.query(ProposalUndertake.class, Cnd.where(ProposalUndertake::getId, "in", undertakeIds));
+    }
 }