diff --git a/video-gen-api/app/api/v1/admin.py b/video-gen-api/app/api/v1/admin.py
index 604bc6ba..b7219a40 100644
--- a/video-gen-api/app/api/v1/admin.py
+++ b/video-gen-api/app/api/v1/admin.py
@@ -5,7 +5,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy import delete, func, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.dependencies import get_db, get_admin_user
+from app.dependencies import get_db, get_admin_user, require_menu_access
 from app.models.user import User
 from app.models.project import Project
 from app.models.generation_record import GenerationRecord
@@ -1663,7 +1663,7 @@ async def list_operation_logs(
 
 @router.get("/stats", response_model=AdminStatsOut)
 async def get_stats(
-    admin: User = Depends(get_admin_user),
+    admin: User = Depends(require_menu_access("/")),
     db: AsyncSession = Depends(get_db),
     start_date: str = Query(None),
     end_date: str = Query(None),
diff --git a/video-gen-api/app/dependencies.py b/video-gen-api/app/dependencies.py
index 38de6d74..e11d1523 100644
--- a/video-gen-api/app/dependencies.py
+++ b/video-gen-api/app/dependencies.py
@@ -115,3 +115,34 @@ async def get_backend_user(
             detail="需要后台用户权限",
         )
     return current_user
+
+
+def require_menu_access(menu_path: str):
+    """检查后台用户是否有指定菜单权限。
+
+    - 超级管理员 (is_admin=True): 直接放行
+    - 非管理员后台用户: 检查 allowed_menus 是否包含 menu_path
+    - 非后台用户: 403 拒绝
+
+    用法:
+        @router.get("/stats")
+        async def get_stats(admin: User = Depends(require_menu_access("/")), ...):
+    """
+    async def _dependency(
+        current_user: User = Depends(get_current_user_allow_password_pending),
+    ) -> User:
+        if current_user.user_type != "admin":
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="需要后台用户权限",
+            )
+        if current_user.is_admin:
+            return current_user
+        allowed = set(current_user.allowed_menus or [])
+        if menu_path not in allowed:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="需要管理员权限",
+            )
+        return current_user
+    return _dependency