This security note is obsolete and replaced with security note 1596907.

1.) You can use transaction SE38 or transaction SE80 to execute an executable program (report) in the standard SAP system if you have display or change authorization and if the report is not assigned to any authorization group.

2.) If you use any navigation steps to display an executable program, you can use the menu option “Program -> Execute” to execute the program as long as it is not assigned to an authorization group.

3.) If you use any navigation steps to display an executable program, you can use the context menu of the object list of the object browser to execute the program, provided it is not assigned to an authorization group.

Example of this type of navigation:
a) You call transaction SE09 and display a request that contains an executable program. If you have display or change authorization, you can double-click to navigate to the program in display mode. If the program is not assigned to an authorization group, you can execute this program.

b) You call transaction ST22 and display a dump. From there, you can display the program if you have display or change authorization.
You can execute this program if it is an executable program and is not assigned to an authorization group.

Examples a) and b) depict just two navigation options. In the ABAP Workbench, there are even more ways in which you can navigate to display a program. This note applies to all of these navigation cases.