diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6343d58b04..b421ffc6da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 
 - Fixed a transaction timeout for presets in the historical market data table of the admin control panel
+- Added the missing permission check in the `GET api/v1/import/dividends/:dataSource/:symbol` endpoint
 
 ## 3.90.0 - 2026-10-21
 
diff --git a/apps/api/src/app/__snapshots__/app.module.spec.ts.snap b/apps/api/src/app/__snapshots__/app.module.spec.ts.snap
index 6d23e3bf7a..927ecc7ebc 100644
--- a/apps/api/src/app/__snapshots__/app.module.spec.ts.snap
+++ b/apps/api/src/app/__snapshots__/app.module.spec.ts.snap
@@ -548,6 +548,7 @@ exports[`AppModule should keep the security of each route 1`] = `
       "TransformDataSourceInResponseInterceptor",
       "TransformDataSourceInRequestInterceptor",
     ],
+    "permission": "createActivity",
   },
   "GET /info": {
     "guards": [],
diff --git a/apps/api/src/app/endpoints/import/import.controller.ts b/apps/api/src/app/endpoints/import/import.controller.ts
index 846914bd03..9c5c162e4d 100644
--- a/apps/api/src/app/endpoints/import/import.controller.ts
+++ b/apps/api/src/app/endpoints/import/import.controller.ts
@@ -81,6 +81,7 @@ export class ImportController {
   }
 
   @Get('dividends/:dataSource/:symbol')
+  @HasPermission(permissions.createActivity)
   @UseGuards(AuthGuard('jwt'), HasPermissionGuard)
   @UseInterceptors(TransformDataSourceInRequestInterceptor)
   @UseInterceptors(TransformDataSourceInResponseInterceptor)