It becomes clearer. It seems then that the BAPI doesn't properly apply the users authorisations. It should check that the user has the authorisation to change at least what they have authority to change.
Maybe the way forward would be to raise a call with SAP asking for the BAPI to be updated? (This is what I did when a support pack enlarged the scope of a BAPI, but that required the users to suddenly have the authorisation to do all the enlarged scope - I did get a response and a fix quite quickly).
However, I've search this site (which is what you should have done first of all) and it seems this is a common problem. One poster BAPI_MATERIAL_SAVEDATA and Authorization Object suggests that although you get the error message - the change is made. If that is the case, then just ignore the error message.