diff --git a/trytond/CHANGELOG b/trytond/CHANGELOG
index 05da52f1f5..fb07075aeb 100644
--- a/trytond/CHANGELOG
+++ b/trytond/CHANGELOG
@@ -1,3 +1,4 @@
+* Check read access of report records (#13505)
 
 Version 6.0.51 - 2024-09-01
 ---------------------------
diff --git a/trytond/trytond/report/report.py b/trytond/trytond/report/report.py
index ce282053cb..3e885cd5c4 100644
--- a/trytond/trytond/report/report.py
+++ b/trytond/trytond/report/report.py
@@ -143,6 +143,7 @@ class Report(URLMixin, PoolBase):
         '''
         pool = Pool()
         ActionReport = pool.get('ir.action.report')
+        ModelAccess = pool.get('ir.model.access')
         cls.check_access()
 
         action_id = data.get('action_id')
@@ -180,6 +181,13 @@ class Report(URLMixin, PoolBase):
         if model:
             records = cls._get_records(ids, model, data)
 
+        with Transaction().set_context(_check_access=True):
+            if model:
+                Model = pool.get(model)
+                ModelAccess.check(model, 'read')
+                # Check read access
+                Model.read(ids, ['id'])
+
         if not records:
             groups = [[]]
             headers = [{}]