status of zabbix should not be shown on dashboard for non-superadmin users, and it also should not be accessible by such users in the reports section (but it should not be hidden there - ideally, a message should say that its only available for superadmins).
entering report1 url directly should check the permissions as well.