Access to records of report are not checked
Since 982a131026e7 the access rights are no more checked on instances. So anyone who has access to the report action, can execute the report to any records.
We should check access like we did on wizard in 2bec62d40123.
This was reported to me by @albertca