Missing authorization check in SAP Records Management, SAP security note 2149278

SAP security note 2149278, “Missing authorization check in SAP Records Management”, is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can utilize functions within SAP Records Management that should be restricted, potentially leading to an escalation of privileges.

Solution

Apply the relevant Support Package as detailed in this SAP Note or follow the provided correction instructions to implement the necessary authorization checks.

Reason and prerequisites

SAP Records Management lacks proper authorization checks for certain functions. This oversight can result in unintended system behavior, allowing users to access or manipulate functionalities beyond their authorized permissions.

Unauthorized access to restricted functions may lead to data breaches, modification of records, or other security compromises within the SAP environment.