What investigation other than SU53 have you done?
Did you generate the PFCG role and also check SU56 for the user buffer before retesting? If the user has then authorisation. If that fine...
It's a Y transaction code so most likely a custom program. Did the developer hard code an asterisk or make a mistake with programming the AUTHORITY CHECK?