Missing authorization check in LE-DSD and SD-SLS-PLL, SAP security note 2026361

SAP security note 2026361, “Missing authorization check in LE-DSD and SD-SLS-PLL”, is a note. Below is the security information published by SAP for this note.

Description

Symptom

Several RFC Function Modules in LE-DSD (Direct Store Delivery) require supplementary authorization checks to ensure better security.

Reason and prerequisites

Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. However, it has been identified that S_RFC authorization checks might not be sufficient to ensure secure execution for RFC function modules covered by this note.

Solution

Implement the attached correction instructions for release EA-APPL 600 and higher to fix the authorization check gap and perform the necessary manual activities. For Release EA-APPL 500, apply the corrections via the appropriate support package.

Steps to Implement: 1. Check Authorization Object: In transaction SU21, verify if authorization object D_SDPR exists. If it exists, skip to step 4.

2. Create Authorization Fields: In transaction SU20, create new authorization fields under package /DSD/PR:

• /DSD/KUNNR – Customer Number
• /DSD/SPART – Division
• /DSD/VKORG – Sales Organization
• /DSD/VTWEG – Distribution Channel
• /DSD/WERKS – Delivering Plant

3. Create Authorization Object: In transaction SU21, create the new authorization object D_SDPR with the defined fields and activities:

• Authorization Fields:
• /DSD/KUNNR
• /DSD/VKORG
• /DSD/VTWEG
• /DSD/SPART
• /DSD/WERKS
• ACTVT
• Activities:
• 01 = Create a promotion
• 02 = Change a promotion
• 03 = Display a promotion
• 06 = Delete a promotion

4. Regenerate SAP_ALL: In transaction SU21, regenerate SAP_ALL to apply the changes.