Yes, the Nagios sbin directory appears to be executable by everyone.
$ ls -la sbin
total 3312
drwxrwxr-x 2 group owner 4096 Oct 31 2012 ./
drwxrwxr-x 9 group owner 4096 Nov 1 2012 ../
-rwxrwxr-x 1 group owner 239312 Oct 31 2012 avail.cgi*
-rwxrwxr-x 1 group owner 244152 Oct 31 2012 cmd.cgi*
-rwxrwxr-x 1 group owner 210608 Oct 31 2012 config.cgi*
-rwxrwxr-x 1 group owner 255696 Oct 31 2012 extinfo.cgi*
-rwxrwxr-x 1 group owner 189096 Oct 31 2012 histogram.cgi*
-rwxrwxr-x 1 group owner 186288 Oct 31 2012 history.cgi*
-rwxrwxr-x 1 group owner 186032 Oct 31 2012 notifications.cgi*
-rwxrwxr-x 1 group owner 177904 Oct 31 2012 outages.cgi*
-rwxrwxr-x 1 group owner 182448 Oct 31 2012 showlog.cgi*
-rwxrwxr-x 1 group owner 244304 Oct 31 2012 status.cgi*
-rwxrwxr-x 1 group owner 185032 Oct 31 2012 statusmap.cgi*
-rwxrwxr-x 1 group owner 198352 Oct 31 2012 statuswml.cgi*
-rwxrwxr-x 1 group owner 182992 Oct 31 2012 statuswrl.cgi*
-rwxrwxr-x 1 group owner 206576 Oct 31 2012 summary.cgi*
-rwxrwxr-x 1 group owner 198384 Oct 31 2012 tac.cgi*
-rwxrwxr-x 1 group owner 193192 Oct 31 2012 trends.cgi*
However, Chrome's version of Firebug shows the following message when I click on the "host" link. It appears as if the browsers don't really know how to interpret this particular "host" link, but the other Nagios cgi links appear to function properly.
Resource interpreted as Document but transferred with MIME type application/octet-stream: "
http://localhost:8881/nagios/cgi-bin/st ... hostdetail"