The javacript rpc handler (jsrpc.php) does not check user permissions when replying to hosts. The result is that users receive alerts for hosts that they do not have permission to view.

This can be troublesome in environments where multiple departments are using a single Zabbix instance.

I have created and tested a patch for this issue for version 1.8.12, but presumably it should work for other versions as well.