Skip links
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

Security Check Call transaction authorization checks, SAP security note 1424979

SAP Note 1424979

SAP security note 1424979, "Security Check: Call transaction authorization checks", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

Users who do not have authorization to call specific transactions are able to do so, bypassing the necessary authorization checks.

Solution

Follow these manual steps to resolve the issue:

  • Step 1: Open transaction SE91 and navigate to the message class /SAPAPO/MSPPPEMSP in change mode. Add new message: Message Number 002, Message Text "No Authorization to call transaction &1 ‘X’". Save your changes.
  • Step 2: Open transaction SE91 again and navigate to the message class /SAPAPO/MSPAPO in change mode. Add new message: Message Number 055, Message Text "No Authorization to call transaction &1 ‘X’". Save your changes.
  • Implementation: Apply the SAP Note or the corresponding support package to ensure all changes are correctly implemented.

Full note on SAP: SAP Support Launchpad note 1424979

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

Explore More