diff --git a/backend-pg/src/services/secret-import/secret-import-service.ts b/backend-pg/src/services/secret-import/secret-import-service.ts
index 75de3f54b..9021fc744 100644
--- a/backend-pg/src/services/secret-import/secret-import-service.ts
+++ b/backend-pg/src/services/secret-import/secret-import-service.ts
@@ -48,11 +48,19 @@ export const secretImportServiceFactory = ({
     path
   }: TCreateSecretImportDTO) => {
     const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
+    
+    // check if user has permission to import into destination  path
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
+    // check if user has permission to import from target path
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.Secrets, { environment: data.environment, secretPath: data.path })
+    );
+
     const folder = await folderDal.findBySecretPath(projectId, environment, path);
     if (!folder) throw new BadRequestError({ message: "Folder not found", name: "Create import" });