Access to ZMSS## t-codes in R/3 by non-HR Users

Question

In our production system, a user with no HR access was able to access the following transaction codes:
ZMSS01
ZMSS02
ZMSS03
ZMSS04
ZMSS05
These transactions cannot be accessed from the main SAP Easy Access Menu (in R/3). But if you are in a different transaction code and you type “/nZMSS##”, then it opens the transaction. For example, a non-HR user from the Finance team was in transaction ZKKS1 (Variances: Manufacturing Orders and Product Cost Collectors) was able to type /nZMSS01 and accessed the HR reports.
These are all t-codes that were built for use on the Enterprise Portal to run reports. When used in R/3, they open the same reports.  Since the user does not have any HR authorizations, they were not able to execute the reports to get results, however this is a security concern as a non-HR user has access to HR reporting screens (even though they cannot execute the reports).
Is anyone familiar with how users could be getting this additional access? Also how does a user have access to the transactions ZMSS## from another SAP transaction but not from the SAP Easy Access Menu? Is there a way to restrict access to these report transactions?
Thank you,
Gao

Answer 1

Gao,
Did the developers of the t_codes add authorization objects to the transaction codes and programs? If not they should as that is the security restriction you add to a transaction to limit users.
Go t_code SE93 --> Enter ZMSS01 --> Display and see the authorization object field and maintain the Authorization Object for this t_code.
*Documentation:
Auth. object in user master maintenance
Element of the authorization system.
An authorization object combines up to 10 authorization fields, which are checked using the AND connective.
Authorizations are checked against objects in the system. Authorization objects enable complex checks (linked to several conditions) of an authorization. For the authorization check to be successful, the user must pass the check for each field contained in the object.
Procedure
Enter the name of the authorization object, which is checked against the authorizations of the calling user when a transaction is started. If the user does not have the necessary authorizations, the transaction will be cancelled.
You should normally specify an object, which is also checked within the program.
This check only takes place when calls are made via START TRANSACTION and via the entry "/n<Transaction code>".
The check is not performed for CALL TRANSACTION or for parameter transactions. If a critical transaction is called in this way, it is the responsibility of the caller to perform the necessary check (AUTHORITY-CHECK).