Security Check Call transaction authorization checks, SAP security note 1426028

SAP security note 1426028, "Security Check: Call Transaction Authorization Checks", is a program error note released on December 11, 2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Users who lack authorization to call certain transactions can do so because the required authorization checks are missing in the main program where the call is being made.

Solution

To address this issue, follow the manual correction steps below:

• Open Message Class: navigate to transaction SE91. Open message class /SAPAPO/DMRES in change mode.
• Add New Message: add a new message with the following details: Message Number 885, Message Short Text “No authority to call transaction &1 ‘X'”.
• Save Changes: save the new message in the message class.
• Implement the Note: apply SAP Note 1426028 or the corresponding support package to ensure the changes take effect.

Reason and prerequisites

This is due to a program error where necessary authorization checks are not implemented, allowing unauthorized access to specific transactions.

Affected components

• SCM_APO 30A
• SCM_APO 310
• SCM 400
• SCM 410
• SCM 500
• SCM_BASIS 510
• SCM_BASIS 700