diff --git a/server/routes.ts b/server/routes.ts
index 843cc9d..ec6e7bf 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -1645,6 +1645,11 @@ export async function registerRoutes(app: Express): Promise<Server> {
         return res.status(404).json({ message: "User not found" });
       }
 
+      // Check permissions for creating tasks
+      if (!hasPermission(user.role, 'tasks', 'create')) {
+        return res.status(403).json({ message: "Permission denied: cannot create tasks" });
+      }
+
       const data = {
         ...req.body,
         createdBy: user.id,
diff --git a/shared/permissions.ts b/shared/permissions.ts
index 4b54fed..c978306 100644
--- a/shared/permissions.ts
+++ b/shared/permissions.ts
@@ -80,11 +80,11 @@ const PERMISSIONS: Record<Module, Record<Role, Permission[]>> = {
     employee: ['view', 'create']
   },
 
-  // Tâches - Admin/Directeur tout, Manager view + validate, Employé view seulement
+  // Tâches - Admin/Directeur tout, Manager view + create + edit + validate, Employé view seulement
   tasks: {
     admin: ['view', 'create', 'edit', 'delete', 'validate'],
     directeur: ['view', 'create', 'edit', 'delete', 'validate'],
-    manager: ['view', 'validate'],
+    manager: ['view', 'create', 'edit', 'validate'],
     employee: ['view']
   }
 };