It was reported that sosreport creates output files with world-readable permissions:

-rw-r--r--. 1 root root 7331624 May 4 08:55 sosreport-localhost.localdomain-20150504084328.tar.xz -rw-r--r--. 1 root root 33 May 4 08:55 sosreport-localhost.localdomain-20150504084328.tar.xz.md5

The archive may consists of files originally only accessible by the root user. However, after extracting the archive, all of the files are readable by regular users with access to /var/tmp/.

Acknowledgements:

Red Hat would like to thank Grant Murphy for reporting this issue.