Report user permissions versus folder access
Key Takeaway
To open a report, a user needs both access to the report's folder and the necessary user permission. A high folder access level doesn't make up for a missing user permission.
In Salesforce, you share reports and dashboards by sharing the folders they are saved in. After that, what a user can do with a report depends on two separate layers. The first is the access level the user has on the folder (View, Edit, or Manage). The second is the report and dashboard user permissions that an admin assigns to the user.
What a user needs to open a report or dashboard
Folders keep reports and dashboards organized, and they are also how you share them. You share the folder, not each report or dashboard on its own.
To open a report or dashboard, a user needs two things: access to the folder where it's saved, and the necessary user permission. For example, to run a report, a user needs access to the report's folder plus the "Run Reports" user permission. To open a Data 360 report or dashboard, a user also needs access to Data 360.