Kimai versions prior to 2.57.0 have an improper authorization vulnerability (CVE-2026-52821) in the preset-project activity creation flow. Users with the create_activity permission but without access to a specific project can create new Activity objects under that unauthorized project by accessing the preset project creation endpoint directly. The controllers (ActivityController and ProjectController) only check global create permissions but do not verify if the user is allowed to create activities or projects under the specified project or customer. This leads to persistent unauthorized creation of business objects in projects outside the user's authorized scope. The vulnerability is addressed by adding explicit edit permission checks ([IsGranted('edit', 'project')] and [IsGranted('edit', 'customer')]) in the respective controllers.

An authenticated user with create_activity permission can inject new activities into projects they are not authorized to access. This can pollute other teams' project configurations, influence timesheet selections and rate inheritance, and create conditions for potential downstream business abuse if other users utilize the injected activities. The vulnerability does not allow viewing or editing the unauthorized project directly but enables unauthorized creation of child objects under it.

A fix is available in Kimai version 2.57.0 and later, which adds explicit authorization checks to verify if the user has edit permissions on the target project or customer before allowing activity or project creation. Users should upgrade to version 2.57.0 or later to remediate this vulnerability. No additional mitigations are required if the upgrade is applied.