Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity creation flow. A user with the generic "create_activity" permission, but without access to a target project, can still create a new "Activity" under that unauthorized project by visiting the preset project creation route directly. This is a persistent cross-project business-object creation issue. The attacker does not need permission to view or edit the target project and only needs to know a valid "project.id".