diff --git a/backend/apps/data_training/api/data_training.py b/backend/apps/data_training/api/data_training.py
index 2e5bf77b4..e10c8164d 100644
--- a/backend/apps/data_training/api/data_training.py
+++ b/backend/apps/data_training/api/data_training.py
@@ -160,6 +160,7 @@ def inner():
 
 @router.post("/uploadExcel", summary=f"{PLACEHOLDER_PREFIX}upload_excel_dt")
 @system_log(LogConfig(operation_type=OperationType.IMPORT, module=OperationModules.DATA_TRAINING))
+@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
 async def upload_excel(trans: Trans, current_user: CurrentUser, file: UploadFile = File(...)):
     ALLOWED_EXTENSIONS = {"xlsx", "xls"}
     if not file.filename.lower().endswith(tuple(ALLOWED_EXTENSIONS)):