diff --git a/mod/h5pactivity/classes/local/manager.php b/mod/h5pactivity/classes/local/manager.php
index 412aa2c346b..7522024ed22 100644
--- a/mod/h5pactivity/classes/local/manager.php
+++ b/mod/h5pactivity/classes/local/manager.php
@@ -451,7 +451,9 @@ class manager {
      * @return report|null available report (or null if no report available)
      */
     public function get_report(int $userid = null, int $attemptid = null, $currentgroup = false): ?report {
-        global $USER;
+        global $USER, $CFG;
+
+        require_once("{$CFG->dirroot}/user/lib.php");
 
         // If tracking is disabled, no reports are available.
         if (!$this->instance->enabletracking) {
@@ -470,6 +472,14 @@ class manager {
 
         if ($this->can_view_all_attempts()) {
             $user = core_user::get_user($userid);
+
+            // Ensure user can view the attempt of specific userid, respecting access checks.
+            if ($user && $user->id != $USER->id) {
+                $course = get_course($this->coursemodule->course);
+                if ($this->coursemodule->effectivegroupmode == SEPARATEGROUPS && !user_can_view_profile($user, $course)) {
+                    return null;
+                }
+            }
         } else if ($this->can_view_own_attempts()) {
             $user = core_user::get_user($USER->id);
             if ($userid && $user->id != $userid) {