diff --git a/api/account/account.go b/api/account/account.go
index 55b743d..b5996d2 100644
--- a/api/account/account.go
+++ b/api/account/account.go
@@ -218,6 +218,18 @@ func HandleDeleteAccount(c *gin.Context) {
 		return
 	}
 
+	// 检查账号是否归属请求用户
+	ownerUID, err := getAccountOwnerUID(accountID)
+	if err != nil {
+		response.ServerError(c, "获取账号所属用户失败")
+		return
+	}
+
+	if ownerUID != userInfo.ID {
+		response.Forbidden(c, "无权限操作该账号")
+		return
+	}
+
 	// 删除相关规则
 	rules, err := getRulesByAccountID(accountID, userInfo.ID)
 	if err != nil {
diff --git a/api/account/tool.go b/api/account/tool.go
index 534f004..2081bb4 100644
--- a/api/account/tool.go
+++ b/api/account/tool.go
@@ -59,3 +59,17 @@ func maskAccounts(accounts []model.Account) []model.Account {
 	}
 	return masked
 }
+
+// getAccountOwnerUID 获取账号所属用户的 UID
+func getAccountOwnerUID(accountID uint) (uint, error) {
+	gormDB, err := db.GetGormDB()
+	if err != nil {
+		return 0, err
+	}
+
+	var account model.Account
+	if err := gormDB.Select("uid").Where("id = ?", accountID).First(&account).Error; err != nil {
+		return 0, err
+	}
+	return account.UID, nil
+}
diff --git a/api/response/response.go b/api/response/response.go
index ed9de36..3233419 100644
--- a/api/response/response.go
+++ b/api/response/response.go
@@ -40,6 +40,9 @@ func NotFound(c *gin.Context, msg string) { Fail(c, http.StatusNotFound, msg) }
 // ServerError 服务端错误
 func ServerError(c *gin.Context, msg string) { Fail(c, http.StatusInternalServerError, msg) }
 
+// Forbidden 无权限
+func Forbidden(c *gin.Context, msg string) { Fail(c, http.StatusForbidden, msg) }
+
 // FromError 按错误类型选择合适的状态码：
 // 参数校验错误返回 400，其余返回 500
 func FromError(c *gin.Context, err error, fallback string) {
diff --git a/api/rule/rule.go b/api/rule/rule.go
index 3737166..e3d14a6 100644
--- a/api/rule/rule.go
+++ b/api/rule/rule.go
@@ -162,6 +162,16 @@ func HandleDeleteRule(c *gin.Context) {
 		return
 	}
 
+	ownerUID, err := getRuleOwnerUID(ruleID)
+	if err != nil {
+		response.ServerError(c, "获取规则所属用户失败")
+		return
+	}
+	if ownerUID != userInfo.ID {
+		response.Forbidden(c, "无权限操作该规则")
+		return
+	}
+
 	if err := DeleteRuleByID(ruleID, userInfo.ID); err != nil {
 		response.ServerError(c, "删除规则失败")
 		return
diff --git a/api/rule/tool.go b/api/rule/tool.go
index 5a3826b..e98b188 100644
--- a/api/rule/tool.go
+++ b/api/rule/tool.go
@@ -103,3 +103,18 @@ func maskRules(rules []model.Rule) []model.Rule {
 	}
 	return masked
 }
+
+// getRuleOwnerUID 获取规则所属用户的 UID
+func getRuleOwnerUID(ruleID uint) (uint, error) {
+	gormDB, err := db.GetGormDB()
+	if err != nil {
+		return 0, err
+	}
+
+	var rule model.Rule
+	if err := gormDB.Select("uid").Where("id = ?", ruleID).First(&rule).Error; err != nil {
+		return 0, err
+	}
+
+	return rule.UID, nil
+}
diff --git a/api/timer/tool.go b/api/timer/tool.go
index 0ac3fc9..33613c2 100644
--- a/api/timer/tool.go
+++ b/api/timer/tool.go
@@ -70,3 +70,17 @@ func signTimer(timer *model.Timer) error {
 	timer.Triggered = false
 	return nil
 }
+
+// getTimerOwnerUID 获取 Timer 的所属用户 ID
+func getTimerOwnerUID(timerID uint) (uint, error) {
+	gormDB, err := db.GetGormDB()
+	if err != nil {
+		return 0, err
+	}
+
+	var timer model.Timer
+	if err := gormDB.Select("uid").Where("id = ?", timerID).First(&timer).Error; err != nil {
+		return 0, err
+	}
+	return timer.UID, nil
+}