also ping @mlutfy

Thanks @seamuslee001 !
But, are you sure this is needed?
I'm spot checking on one instance I don't see that a user without Access CiviReports can see anything at that URL.
I don't get access denied, but it says, "No reports have been created. Contact your site administrator for help creating reports.", which is not true, so seems fine without this change.

@ginkgomzd try https://civicrm.org/civicrm/report/list

huh, that's interesting... I just tried a bunch of random civicrm sites... and none of them are displaying that. Was there a change in the permission checks in core?

I'm not against the change, just curious what is going on.

I'm not sure maybe @mlutfy can check and see what is going on perhaps. I haven't seen any changes to this https://github.com/civicrm/civicrm-core/blob/master/CRM/Report/Page/InstanceList.php#L164 or https://github.com/civicrm/civicrm-core/blob/master/CRM/Report/Utils/Report.php#L346 to suggest that there have been changes in the core code but not sure

It's odd: the civicrm_report_instance table had empty values for the permissions/roles. I re-saved the report instance, and then it was fine (i.e. saved in DB).