Record sharing and report row visibility
Key Takeaway
The rows a user sees in a report depend on that user's own record access.
Reports follow the same security model as the rest of Salesforce. Object permissions and field-level security decide which objects and fields a user can see, and record-level sharing decides which records a user can view and report on.
Opening a report and seeing its records
Opening a report and seeing its records are separate controls. Folder access and user permissions such as "Run Reports" decide who can reach a report. After a user opens a report, the user's own record access decides which rows appear.
For example, imagine two users who can both open the same report. If their record access differs, the rows they see can differ too.