List endpoints usually filter by tenant and role. Reports often skip that. Someone builds a revenue report that joins orders to customers and territories , then runs a raw SQL query or an ORM join with no per-table access filter.
Source: [Dev.to](https://dev.to/authbyexample1/a-report-that-joins-tables-can-leak-rows-your-list-pages-would-hide-52kk)