The authentication is independent from the profile rights. So you do not have to create a new PEA file provided that the option for "Profile Secret" is "unchanged" The CLI menu varies depending upon the CentraStar version.
The following example uses 4.x.
The "q" right was removed in this example. PEA file remained unchanged.

Config# update profile test
Enable Profile? (yes, no) [yes]:
Change Data Access Capabilities (yes, no) [no]: yes
Home Pool [default]:
Granted Rights for the Profile in the Home Pool [rdqeDcw-]: rdeDcw
Profile-Metadata Capability? (yes, no) [no]:
Change Cluster Management Roles (yes, no) [no]:
Password Persistency Scheme (obfuscated, hashed) [obfuscated]:
Profile Secret (unchanged, prompt, generate, file) [unchanged]:

Warning: Please be aware that updating a profile may impact
functionality/access from a customer application. Please follow up with the
customer to ensure connectivity after the maintenance activity.

Issue the command?
(yes, no) [no]: yes
Establish a Pool Entry Authorization for application use? (yes, no) [no]: no

Hi Darmin

I wanted to add that sometimes a re-connect of the application is necessary to make the application detect the changed capabilities / rights.

Holger