diff --git a/backend/app/admin/service/auth_service.py b/backend/app/admin/service/auth_service.py
index 45c409cd..e938cafa 100644
--- a/backend/app/admin/service/auth_service.py
+++ b/backend/app/admin/service/auth_service.py
@@ -202,14 +202,14 @@ class AuthService:
             menus = await menu_dao.get_all(db, None, None)
             for menu in menus:
                 if menu.perms:
-                    codes.add(*menu.perms.split(','))
+                    codes.update(menu.perms.split(','))
         else:
             roles = request.user.roles
             if roles:
                 for role in roles:
                     for menu in role.menus:
                         if menu.perms:
-                            codes.add(*menu.perms.split(','))
+                            codes.update(menu.perms.split(','))
 
         return list(codes)
 
diff --git a/backend/common/security/jwt.py b/backend/common/security/jwt.py
index 4311b075..2d3eeb6f 100644
--- a/backend/common/security/jwt.py
+++ b/backend/common/security/jwt.py
@@ -265,7 +265,7 @@ async def get_current_user(db: AsyncSession, pk: int) -> User:
         raise errors.TokenError(msg='Token 无效')
     if not user.status:
         raise errors.AuthorizationError(msg='用户已被锁定，请联系系统管理员')
-    if user.dept_id:
+    if user.dept and user.dept_id:
         if not user.dept.status:
             raise errors.AuthorizationError(msg='用户所属部门已被锁定，请联系系统管理员')
         if user.dept.del_flag:
diff --git a/backend/common/security/rbac.py b/backend/common/security/rbac.py
index 61f4c718..0839188a 100644
--- a/backend/common/security/rbac.py
+++ b/backend/common/security/rbac.py
@@ -34,16 +34,19 @@ async def rbac_verify(request: Request, _token: str = DependsJwtAuth) -> None:
 
     # 检测用户角色
     user_roles = request.user.roles
-    if not user_roles or all(status == 0 for status in user_roles):
+    if not user_roles:
         raise errors.AuthorizationError(msg='用户未分配角色，请联系系统管理员')
+    enabled_roles = [role for role in user_roles if role.status == StatusType.enable]
+    if not enabled_roles:
+        raise errors.AuthorizationError(msg='用户所属角色已被锁定，请联系系统管理员')
 
     # 检测用户所属角色菜单
-    if not any(len(role.menus) > 0 for role in user_roles):
+    if not any(len(role.menus) > 0 for role in enabled_roles):
         raise errors.AuthorizationError(msg='用户未分配菜单，请联系系统管理员')
 
     # 检测后台管理操作权限
     method = request.method
-    if (method != MethodType.GET or method != MethodType.OPTIONS) and not request.user.is_staff:
+    if method not in {MethodType.GET, MethodType.OPTIONS} and not request.user.is_staff:
         raise errors.AuthorizationError(msg='用户已被禁止后台管理操作，请联系系统管理员')
 
     # RBAC 鉴权
@@ -60,7 +63,7 @@ async def rbac_verify(request: Request, _token: str = DependsJwtAuth) -> None:
 
         # 菜单去重
         unique_menus = {}
-        for role in user_roles:
+        for role in enabled_roles:
             for menu in role.menus:
                 unique_menus[menu.id] = menu