diff --git a/course/user.php b/course/user.php
index cbf9152ae0b..d212054eedd 100644
--- a/course/user.php
+++ b/course/user.php
@@ -155,8 +155,11 @@
             if (empty($stats)) {
                 error(get_string('nostatstodisplay'), $CFG->wwwroot.'/course/user.php?id='.$course->id.'&user='.$user->id.'&mode=outline');
             }
-
-            echo '<center><img src="'.$CFG->wwwroot.'/course/report/stats/graph.php?mode='.STATS_MODE_DETAILED.'&course='.$course->id.'&time='.$time.'&report='.STATS_REPORT_USER_VIEW.'&userid='.$user->id.'" alt="'.get_string('statisticsgraph').'" /></center>';
+    
+            // MDL-10818, do not display broken graph when user has no permission to view graph
+            if (has_capability('moodle/site:viewreports', get_context_instance(CONTEXT_COURSE, $id))) {
+                echo '<center><img src="'.$CFG->wwwroot.'/course/report/stats/graph.php?mode='.STATS_MODE_DETAILED.'&course='.$course->id.'&time='.$time.'&report='.STATS_REPORT_USER_VIEW.'&userid='.$user->id.'" alt="'.get_string('statisticsgraph').'" /></center>';
+            }
 
             // What the heck is this about?   -- MD
             $stats = stats_fix_zeros($stats,$param->timeafter,$param->table,(!empty($param->line2)),(!empty($param->line3)));