The page properties report macro had a bug in it - CONF-30125 - where it would display pages without regard to the privacy of the page itself.

While this is a security risk, there are customers who've come to rely on this functionality. For example, one customer uses it to display the overall status of a project, without exposing the particulars of a project to the whole of their staff.

After the bug was fixed in CONF-30125, reports only displayed items that the viewer had access to - which causes problems for customers who were relying on it's previous behaviour.

It would be nice if there was an option to "impersonate" a user - that is, to list pages that the impersonated user could see (rather than the viewer); along with the appropriate notice that it is a security risk.