diff --git a/apps/common/auth/handle/impl/user_token.py b/apps/common/auth/handle/impl/user_token.py
index 9c025066b6f..5f66ee42897 100644
--- a/apps/common/auth/handle/impl/user_token.py
+++ b/apps/common/auth/handle/impl/user_token.py
@@ -110,7 +110,7 @@ def get_permissions(
                     for role_id in role_ids:
                         for m in role_permission_mapping_dict.get(str(role_id)) or []:
                             p = PERMISSION_STR_MAP.get(m.permission_id)
-                            if PermissionScopeConstants.WORKSPACE in p.meta.scope:
+                            if p is not None and PermissionScopeConstants.WORKSPACE in p.meta.scope:
                                 permissions.append(p)
 
                     for group, ps in group_by(permissions, lambda p: p.meta.group).items():
diff --git a/apps/knowledge/models/knowledge.py b/apps/knowledge/models/knowledge.py
index 19a7f010c1b..16790ee94e4 100644
--- a/apps/knowledge/models/knowledge.py
+++ b/apps/knowledge/models/knowledge.py
@@ -529,6 +529,8 @@ class FileSourceType(models.TextChoices):
     TEMPORARY_120_MINUTE = "TEMPORARY_120_MINUTE"
     # 临时1天 数据1天后被清理 source_id为TEMPORARY_1_DAY
     TEMPORARY_1_DAY = "TEMPORARY_1_DAY"
+    # 应用的icon 背景图等 用户的icon
+    APPLICATION_SETTINGS = "APPLICATION_SETTINGS"
 
 
 class VectorField(models.Field):
diff --git a/apps/oss/serializers/file.py b/apps/oss/serializers/file.py
index 562de6486cb..c4d4009d370 100644
--- a/apps/oss/serializers/file.py
+++ b/apps/oss/serializers/file.py
@@ -174,12 +174,9 @@ def auth(file, mk_file_auth):
     # PublicFileAccess 中记录的文件允许公开访问
     if QuerySet(PublicFileAccess).filter(source_type='FILE', source_id=str(file.id)).exists():
         return
-    if file.source_type == FileSourceType.APPLICATION:
-        application = QuerySet(Application).filter(id=file.source_id).first()
-        if application is None:
-            _deny()
-        if file.meta.get('chat_id') is None:
-            return
+    if file.source_type == FileSourceType.APPLICATION_SETTINGS:
+        return
+            
     # 非公共文件,直接拒绝
     if mk_file_auth is None:
         _deny()