diff --git a/par-api/src/main/java/com/par/api/controller/AdminController.java b/par-api/src/main/java/com/par/api/controller/AdminController.java
index 084a178..515b76a 100644
--- a/par-api/src/main/java/com/par/api/controller/AdminController.java
+++ b/par-api/src/main/java/com/par/api/controller/AdminController.java
@@ -1,6 +1,8 @@
 package com.par.api.controller;
 
+import com.par.core.dto.AccountDTO;
 import com.par.core.dto.ApiResponse;
+import com.par.core.entity.Account;
 import com.par.core.entity.SiteConfig;
 import com.par.core.enums.ConfigStatus;
 import com.par.core.enums.TrustLevel;
@@ -8,16 +10,18 @@ import com.par.core.mapper.AccountMapper;
 import com.par.core.mapper.ConfigReviewMapper;
 import com.par.core.mapper.SiteConfigMapper;
 import com.par.core.mapper.SiteMapper;
+import com.par.core.service.AccountService;
 import jakarta.servlet.http.HttpServletRequest;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.web.bind.annotation.*;
 
 import java.time.LocalDateTime;
+import java.util.List;
 
 /**
  * 管理员控制器
- * 所有接口需 HMAC 鉴权 + 管理员权限
+ * 所有接口需鉴权 + 管理员权限
  */
 @Slf4j
 @RestController
@@ -29,6 +33,20 @@ public class AdminController {
     private final ConfigReviewMapper configReviewMapper;
     private final AccountMapper accountMapper;
     private final SiteMapper siteMapper;
+    private final AccountService accountService;
+
+    /**
+     * 获取所有用户列表
+     */
+    @GetMapping("/accounts")
+    public ApiResponse<List<AccountDTO>> listAccounts(HttpServletRequest request) {
+        checkAdmin(request);
+        List<Account> accounts = accountMapper.selectList(null);
+        List<AccountDTO> dtos = accounts.stream()
+                .map(accountService::toDTO)
+                .toList();
+        return ApiResponse.success(dtos);
+    }
 
     /**
      * 审核配置
@@ -36,7 +54,7 @@ public class AdminController {
     @PostMapping("/reviews/{reviewId}/approve")
     public ApiResponse<Void> approveConfig(
             @PathVariable Long reviewId,
-            @RequestParam(required = false) String comment,
+            @RequestParam(value = "comment", required = false) String comment,
             HttpServletRequest request) {
 
         checkAdmin(request);
@@ -78,7 +96,7 @@ public class AdminController {
     @PostMapping("/reviews/{reviewId}/reject")
     public ApiResponse<Void> rejectConfig(
             @PathVariable Long reviewId,
-            @RequestParam String comment,
+            @RequestParam("comment") String comment,
             HttpServletRequest request) {
 
         checkAdmin(request);
@@ -107,7 +125,7 @@ public class AdminController {
     @PostMapping("/accounts/{accountId}/trust-level")
     public ApiResponse<Void> setTrustLevel(
             @PathVariable Long accountId,
-            @RequestParam String level,
+            @RequestParam("level") String level,
             HttpServletRequest request) {
 
         checkAdmin(request);
diff --git a/par-api/src/main/java/com/par/api/controller/ConfigController.java b/par-api/src/main/java/com/par/api/controller/ConfigController.java
index 9205105..31dcff5 100644
--- a/par-api/src/main/java/com/par/api/controller/ConfigController.java
+++ b/par-api/src/main/java/com/par/api/controller/ConfigController.java
@@ -35,6 +35,18 @@ public class ConfigController {
     @Value("${par.static.path:./static}")
     private String staticPath;
 
+    /**
+     * 列出所有待审核配置
+     */
+    @GetMapping("/pending")
+    public ApiResponse<List<SiteConfigDTO>> listPendingConfigs() {
+        List<SiteConfig> configs = configService.listPendingConfigs();
+        List<SiteConfigDTO> dtos = configs.stream()
+                .map(configService::toDTO)
+                .toList();
+        return ApiResponse.success(dtos);
+    }
+
     /**
      * 获取站点最新配置版本列表
      */
diff --git a/par-core/src/main/java/com/par/core/mapper/SiteConfigMapper.java b/par-core/src/main/java/com/par/core/mapper/SiteConfigMapper.java
index c3c78f0..990bd51 100644
--- a/par-core/src/main/java/com/par/core/mapper/SiteConfigMapper.java
+++ b/par-core/src/main/java/com/par/core/mapper/SiteConfigMapper.java
@@ -23,4 +23,7 @@ public interface SiteConfigMapper extends BaseMapper<SiteConfig> {
 
     @Update("UPDATE site_configs SET is_latest = 0 WHERE site_id = #{siteId} AND is_latest = 1 AND deleted = 0")
     int clearLatestFlag(@Param("siteId") String siteId);
+
+    @Select("SELECT * FROM site_configs WHERE status = 'pending' AND deleted = 0 ORDER BY created_at DESC")
+    List<SiteConfig> selectPending();
 }
diff --git a/par-core/src/main/java/com/par/core/service/ConfigService.java b/par-core/src/main/java/com/par/core/service/ConfigService.java
index ad38fe1..63dd52f 100644
--- a/par-core/src/main/java/com/par/core/service/ConfigService.java
+++ b/par-core/src/main/java/com/par/core/service/ConfigService.java
@@ -15,6 +15,11 @@ public interface ConfigService {
      */
     SiteConfig getLatestConfig(String siteId);
 
+    /**
+     * 获取所有待审核配置
+     */
+    List<SiteConfig> listPendingConfigs();
+
     /**
      * 获取站点所有已批准配置版本
      */
diff --git a/par-core/src/main/java/com/par/core/service/impl/ConfigServiceImpl.java b/par-core/src/main/java/com/par/core/service/impl/ConfigServiceImpl.java
index bc3466d..1005dfe 100644
--- a/par-core/src/main/java/com/par/core/service/impl/ConfigServiceImpl.java
+++ b/par-core/src/main/java/com/par/core/service/impl/ConfigServiceImpl.java
@@ -37,6 +37,11 @@ public class ConfigServiceImpl implements ConfigService {
         return siteConfigMapper.selectLatestBySiteId(siteId);
     }
 
+    @Override
+    public List<SiteConfig> listPendingConfigs() {
+        return siteConfigMapper.selectPending();
+    }
+
     @Override
     public List<SiteConfigDTO> listApprovedConfigs(String siteId) {
         return siteConfigMapper.selectApprovedBySiteId(siteId)