diff --git a/src/controllers/ApiManageController.ts b/src/controllers/ApiManageController.ts
index 3effdbd5..a3a205d1 100644
--- a/src/controllers/ApiManageController.ts
+++ b/src/controllers/ApiManageController.ts
@@ -350,6 +350,31 @@ export class ApiManageController extends Controller {
     "next_holderId",
     "current_holderId",
     "ancestorDNA",
+    "leaveCommandId",
+    "posLevelId",
+    "posTypeId",
+    "posExecutiveId",
+    "registrationProvinceId",
+    "registrationDistrictId",
+    "registrationSubDistrictId",
+    "currentProvinceId",
+    "currentDistrictId",
+    "currentSubDistrictId",
+    "isDelete",
+    "keycloak",
+    "statusCheckEdit",
+    "privacyCheckin",
+    "privacyUser",
+    "privacyMgt",
+    "dutyTimeId",
+    "dutyTimeEffectiveDate",
+    "profileId",
+    "profileEmployeeId",
+    "orgRevisionId",
+    "rank",
+    "isUpload",
+    "isDeleted",
+    "isEntry",
   ]; // ฟิลด์ที่ไม่ต้องการแสดงในผลลัพธ์
 
   // การแทนที่ฟิลด์ ID ด้วยฟิลด์ Name สำหรับ Profile entity
diff --git a/src/controllers/CommandController.ts b/src/controllers/CommandController.ts
index 09ab9792..a30a3048 100644
--- a/src/controllers/CommandController.ts
+++ b/src/controllers/CommandController.ts
@@ -206,7 +206,13 @@ export class CommandController extends Controller {
       child4: null,
     };
     if (request.user.role.includes("STAFF")) {
-      _data = await new permission().PermissionOrgList(request, "COMMAND");
+      // #2523 STAFF + isDirector ให้ล้อสิทธิ์เหมือน CHILD
+      if (!isDirector) {
+        _data = await new permission().PermissionOrgList(request, "COMMAND");
+        
+      } else {
+        _data = await new permission().PermissionIsDirectorOrgList(request, "COMMAND", isDirector);
+      }
     }
     if (isDirector || _data.privilege == "OWNER") {
       const profiles = await this.profileRepository
diff --git a/src/interfaces/permission.ts b/src/interfaces/permission.ts
index 4c3063de..5d22d274 100644
--- a/src/interfaces/permission.ts
+++ b/src/interfaces/permission.ts
@@ -39,7 +39,7 @@ class CheckAuth {
         }
       });
   }
-  public async PermissionOrg(req: RequestWithUser, system: string, action: string) {
+  public async PermissionOrg(req: RequestWithUser, system: string, action: string, isDirector?: boolean) {
     if (
       req.headers.hasOwnProperty("api_key") &&
       req.headers["api_key"] &&
@@ -56,7 +56,7 @@ class CheckAuth {
     return await new CallAPI()
       .GetData(req, `/org/permission/org/${system}/${action}`)
       .then(async (x) => {
-        let privilege = x.privilege;
+        let privilege = isDirector && isDirector === true ? "CHILD" : x.privilege;
 
         let data: any = {
           root: [null],
@@ -288,6 +288,9 @@ class CheckAuth {
   public async PermissionOrgList(req: RequestWithUser, system: string) {
     return await this.PermissionOrg(req, system, "LIST");
   }
+  public async PermissionIsDirectorOrgList(req: RequestWithUser, system: string, isDirector: boolean) {
+    return await this.PermissionOrg(req, system, "LIST", isDirector);
+  }
   public async PermissionOrgUpdate(req: RequestWithUser, system: string) {
     return await this.PermissionOrg(req, system, "UPDATE");
   }