diff --git a/server/api/admin/users/[id].put.ts b/server/api/admin/users/[id].put.ts
index f65cf5b..f3ad6ac 100644
--- a/server/api/admin/users/[id].put.ts
+++ b/server/api/admin/users/[id].put.ts
@@ -5,6 +5,7 @@ import { users, userStatusLogs } from '~/drizzle/schema'
 import { eq } from 'drizzle-orm'
 import { updateUserPassword } from '~~/server/services/userService'
 import { getRoleLevel, canChangeRoleOf, canResetPasswordFor } from '~~/server/utils/permissions'
+import { normalizeUserStatus, USER_STATUS_RULE_MESSAGE } from '~~/server/utils/user-status'
 
 export default defineEventHandler(async (event) => {
   try {
@@ -189,11 +190,15 @@ export default defineEventHandler(async (event) => {
       })
     }
 
-    // 验证status字段的有效性
-    if (status && !['active', 'withdrawn', 'graduate'].includes(status)) {
+    /*
+     * 状态：**大小写不敏感**（客户端历史版本发的是大写的 ACTIVE）。
+     * 认不出来才报错 —— 否则管理员会遇到"编辑任何用户都 400"（已踩过）。
+     */
+    const nextStatus = status === undefined || status === null ? null : normalizeUserStatus(status)
+    if (status !== undefined && status !== null && !nextStatus) {
       throw createError({
         statusCode: 400,
-        statusMessage: '用户状态只能是 active, withdrawn 或 graduate'
+        statusMessage: USER_STATUS_RULE_MESSAGE
       })
     }
 
@@ -207,8 +212,8 @@ export default defineEventHandler(async (event) => {
     }
 
     // 如果提供了status，则更新状态相关字段
-    if (status && status !== existingUser[0].status) {
-      updateData.status = status
+    if (nextStatus && nextStatus !== existingUser[0].status) {
+      updateData.status = nextStatus
       updateData.statusChangedAt = new Date()
       updateData.statusChangedBy = user.id
     }
diff --git a/server/api/admin/users/[id]/status.put.ts b/server/api/admin/users/[id]/status.put.ts
index c9137a2..17ee3bf 100644
--- a/server/api/admin/users/[id]/status.put.ts
+++ b/server/api/admin/users/[id]/status.put.ts
@@ -1,4 +1,5 @@
 import { createError, defineEventHandler, getRouterParam, readBody } from 'h3'
+import { normalizeUserStatus, USER_STATUS_RULE_MESSAGE } from '~~/server/utils/user-status'
 import { db } from '~/drizzle/db'
 import { users, userStatusLogs } from '~/drizzle/schema'
 import { eq } from 'drizzle-orm'
@@ -18,13 +19,14 @@ export default defineEventHandler(async (event) => {
 
     const userId = getRouterParam(event, 'id')
     const body = await readBody(event)
-    const { status, reason } = body
+    const { status: rawStatus, reason } = body
 
-    // 验证必填字段
-    if (!status || !['active', 'withdrawn', 'graduate'].includes(status)) {
+    // 验证必填字段；状态大小写不敏感（客户端历史版本发大写 ACTIVE 也能用）
+    const status = normalizeUserStatus(rawStatus)
+    if (!status) {
       throw createError({
         statusCode: 400,
-        statusMessage: '状态必须为 active, withdrawn 或 graduate'
+        statusMessage: USER_STATUS_RULE_MESSAGE
       })
     }
 
diff --git a/server/api/admin/users/batch-status.put.ts b/server/api/admin/users/batch-status.put.ts
index 6e06a39..3091ebd 100644
--- a/server/api/admin/users/batch-status.put.ts
+++ b/server/api/admin/users/batch-status.put.ts
@@ -17,7 +17,7 @@ export default defineEventHandler(async (event) => {
     }
 
     const body = await readBody(event)
-    const { userIds, status, reason } = body
+    const { userIds, status: rawStatus, reason } = body
 
     // 验证必填字段
     if (!Array.isArray(userIds) || userIds.length === 0) {
@@ -27,10 +27,12 @@ export default defineEventHandler(async (event) => {
       })
     }
 
-    if (!status || !['active', 'withdrawn', 'graduate'].includes(status)) {
+    // 状态：大小写不敏感（客户端历史版本发的是大写 ACTIVE）
+    const status = normalizeUserStatus(rawStatus)
+    if (!status) {
       throw createError({
         statusCode: 400,
-        statusMessage: '状态必须为 active, withdrawn 或 graduate'
+        statusMessage: USER_STATUS_RULE_MESSAGE
       })
     }
 
diff --git a/server/utils/user-status.ts b/server/utils/user-status.ts
new file mode 100644
index 0000000..47761f8
--- /dev/null
+++ b/server/utils/user-status.ts
@@ -0,0 +1,27 @@
+import { eq } from 'drizzle-orm'
+
+/**
+ * 用户状态（`users.status`）的唯一口径。
+ *
+ * ⚠️ 这里踩过一次真实的坑：小程序端一直发**大写** `ACTIVE`，
+ * 而服务端与 DB 用的是**小写** `active` / `withdrawn` / `graduate`（登录、2FA、WebAuthn
+ * 等地方都按小写判断）。于是管理员在用户管理里**编辑任何用户**都会被
+ * 「用户状态只能是 active, withdrawn 或 graduate」拒绝 —— 看起来像"编辑功能坏了"。
+ *
+ * 所以状态统一走这里的 `normalizeUserStatus()`：**大小写不敏感**，
+ * 认不出来的值返回 null，由调用方决定是报错还是忽略（创建用户时忽略、编辑时可报错）。
+ */
+export const USER_STATUSES = ['active', 'withdrawn', 'graduate'] as const
+
+export type UserStatus = (typeof USER_STATUSES)[number]
+
+/** 归一化：`ACTIVE` / `active` / ` Active ` → `active`；其它 → null */
+export function normalizeUserStatus(value: unknown): UserStatus | null {
+  const s = String(value ?? '')
+    .trim()
+    .toLowerCase()
+  return (USER_STATUSES as readonly string[]).includes(s) ? (s as UserStatus) : null
+}
+
+/** 统一的错误文案（列出允许值，别让调用方各写各的） */
+export const USER_STATUS_RULE_MESSAGE = '用户状态只能是 active、withdrawn 或 graduate'