AIKIDO-2026-993954

TL;DR

The team-assignment API endpoints for customers, projects, and activities reuse an existing team when a team with the same name already exists. When reusing that team, Kimai adds the current user as a team lead without checking that the user is authorized to manage the reused team. An authenticated user with project permission-management rights can become team lead of an existing team by matching its name. The fix creates a new team through the protected form routes instead of silently reusing and joining an existing one.