Rundeck versions up to 6.2.1 have an authorization flaw in the project archive import endpoint, specifically with the importConfig and importNodesSources parameters. This vulnerability allows attackers with import permissions to replace critical project configuration files, including security-sensitive settings such as node executors and SSH key paths. The flaw can lead to unauthorized modification of job execution parameters.