diff --git a/src/Controller/Reporting/ReportByUserController.php b/src/Controller/Reporting/ReportByUserController.php
index 8a8c2b59..9462aed1 100644
--- a/src/Controller/Reporting/ReportByUserController.php
+++ b/src/Controller/Reporting/ReportByUserController.php
@@ -42,7 +42,7 @@ final class ReportByUserController extends AbstractController
     private function canSelectUser(): bool
     {
         // also found in App\EventSubscriber\Actions\UserSubscriber
-        if (!$this->isGranted('view_other_timesheet')) {
+        if (!$this->isGranted('view_other_timesheet') || !$this->isGranted('view_other_reporting')) {
             return false;
         }
 
diff --git a/src/EventSubscriber/Actions/UserSubscriber.php b/src/EventSubscriber/Actions/UserSubscriber.php
index 703d6e08..1a809286 100644
--- a/src/EventSubscriber/Actions/UserSubscriber.php
+++ b/src/EventSubscriber/Actions/UserSubscriber.php
@@ -60,7 +60,8 @@ class UserSubscriber extends AbstractActionsSubscriber
 
         $viewOther = $this->isGranted('view_other_timesheet');
         if ($this->isGranted('view_reporting')) {
-            if ($viewOther || ($event->getUser()->getId() === $user->getId())) {
+            // also found in App\Controller\Reporting\ReportByUserController
+            if (($viewOther && $this->isGranted('view_other_reporting')) || ($event->getUser()->getId() === $user->getId())) {
                 $event->addAction('menu.reporting', ['url' => $this->path('report_user_month', ['user' => $user->getId()]), 'icon' => 'reporting']);
             }
         }