diff --git a/backend/app/services/product_service.py b/backend/app/services/product_service.py
index fec49c7..a30275b 100644
--- a/backend/app/services/product_service.py
+++ b/backend/app/services/product_service.py
@@ -301,37 +301,40 @@ async def update_overall_status(
     if not product:
         raise HTTPException(status_code=404, detail=f"未找到序列号 {serial_number} 的产品")
 
-    # ── 权限校验 ──
-    if current_user:
-        user_role = current_user.get("role", "")
-        user_username = current_user.get("username", "")
+    # ── 权限校验（无 current_user 一律拒绝，杜绝空 dict 绕过）──
+    if not current_user:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="请先登录",
+        )
 
-        # SUPER_ADMIN 直接放行
-        if user_role == "SUPER_ADMIN":
-            pass
-        else:
-            # 检查当前用户是否是该产品主线任务的负责人
-            from sqlalchemy import or_
-            main_task_result = await db.execute(
-                select(Task).where(
-                    Task.product_id == product.id,
-                    Task.status.in_(["WIP", "PENDING"]),
-                    or_(
-                        Task.parent_task_id.is_(None),
-                        Task.task_type.in_(["TRANSFER", "RECOVERY"]),
-                    ),
-                ).order_by(Task.created_at.desc()).limit(1)
+    user_role = current_user.get("role", "")
+    user_username = current_user.get("username", "")
+
+    # SUPER_ADMIN 直接放行
+    if user_role != "SUPER_ADMIN":
+        # 检查当前用户是否是该产品主线任务的负责人
+        from sqlalchemy import or_
+        main_task_result = await db.execute(
+            select(Task).where(
+                Task.product_id == product.id,
+                Task.status.in_(["WIP", "PENDING"]),
+                or_(
+                    Task.parent_task_id.is_(None),
+                    Task.task_type.in_(["TRANSFER", "RECOVERY"]),
+                ),
+            ).order_by(Task.created_at.desc()).limit(1)
+        )
+        main_task = main_task_result.scalar_one_or_none()
+        has_permission = (
+            main_task is not None
+            and main_task.assignee_id == user_username
+        )
+        if not has_permission:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="只有 SUPER_ADMIN 或当前操作该产品主线任务的人才能修改宏观状态",
             )
-            main_task = main_task_result.scalar_one_or_none()
-            has_permission = (
-                main_task
-                and main_task.assignee_id == user_username
-            )
-            if not has_permission:
-                raise HTTPException(
-                    status_code=status.HTTP_403_FORBIDDEN,
-                    detail="只有 SUPER_ADMIN 或当前操作该产品主线任务的人才能修改宏观状态",
-                )
 
     product.overall_status = status_value
     await db.commit()