From 1c0f3e1b81de36f06fef6e6605bbebad9f54b14c Mon Sep 17 00:00:00 2001
From: jeremystretch <jstretch@ns1.com>
Date: Fri, 28 May 2021 13:16:25 -0400
Subject: [PATCH] Fixes #6502: Correct permissions evaluation for running a
 report via the REST API

---
 docs/release-notes/version-2.11.md | 4 ++++
 netbox/extras/api/views.py         | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/docs/release-notes/version-2.11.md b/docs/release-notes/version-2.11.md
index b9b86ef91..634e47316 100644
--- a/docs/release-notes/version-2.11.md
+++ b/docs/release-notes/version-2.11.md
@@ -8,6 +8,10 @@
 * [#6487](https://github.com/netbox-community/netbox/issues/6487) - Add location filter to cable connection form
 * [#6501](https://github.com/netbox-community/netbox/issues/6501) - Expose prefix depth and children on REST API serializer
 
+### Bug Fixes
+
+* [#6502](https://github.com/netbox-community/netbox/issues/6502) - Correct permissions evaluation for running a report via the REST API
+
 ---
 
 ## v2.11.4 (2021-05-25)
diff --git a/netbox/extras/api/views.py b/netbox/extras/api/views.py
index 7e6c97782..fbeba8328 100644
--- a/netbox/extras/api/views.py
+++ b/netbox/extras/api/views.py
@@ -239,7 +239,7 @@ class ReportViewSet(ViewSet):
         Run a Report identified as "<module>.<script>" and return the pending JobResult as the result
         """
         # Check that the user has permission to run reports.
-        if not request.user.has_perm('extras.run_script'):
+        if not request.user.has_perm('extras.run_report'):
             raise PermissionDenied("This user does not have permission to run reports.")
 
         # Check that at least one RQ worker is running