SAP security note 2026361, “Missing authorization check in LE-DSD and SD-SLS-PLL”, is a note. Below is the security information published by SAP for this note.
Description
Symptom
Several RFC Function Modules in LE-DSD (Direct Store Delivery) require supplementary authorization checks to ensure better security.
Reason and prerequisites
Remote calls to RFC function modules are protected by checks on the authorization object S_RFC. However, it has been identified that S_RFC authorization checks might not be sufficient to ensure secure execution for RFC function modules covered by this note.
Solution
Implement the attached correction instructions for release EA-APPL 600 and higher to fix the authorization check gap and perform the necessary manual activities. For Release EA-APPL 500, apply the corrections via the appropriate support package.
Steps to Implement: 1. Check Authorization Object: In transaction SU21, verify if authorization object D_SDPR exists. If it exists, skip to step 4.
2. Create Authorization Fields: In transaction SU20, create new authorization fields under package /DSD/PR:
- /DSD/KUNNR – Customer Number
- /DSD/SPART – Division
- /DSD/VKORG – Sales Organization
- /DSD/VTWEG – Distribution Channel
- /DSD/WERKS – Delivering Plant
3. Create Authorization Object: In transaction SU21, create the new authorization object D_SDPR with the defined fields and activities:
- Authorization Fields:
- /DSD/KUNNR
- /DSD/VKORG
- /DSD/VTWEG
- /DSD/SPART
- /DSD/WERKS
- ACTVT
- Activities:
- 01 = Create a promotion
- 02 = Change a promotion
- 03 = Display a promotion
- 06 = Delete a promotion
4. Regenerate SAP_ALL: In transaction SU21, regenerate SAP_ALL to apply the changes.
Full note on SAP: SAP Support Launchpad note 2026361
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
