There are several permissions involved:

• The user needs to be in a User Group that has at least View permissions for "Files" (to browse files) or Add/Upload permissions for uploading (see the File Permissions Panel)
• The user needs to have user or group permissions for a collection to Upload, Read and/or Write (For more information about users and groups permissions, please read this page: Advanced Permissions),
• Additionally, you may have to enable access to the appropriate File Root (see Accessible File Roots for details), which will generally allow users to access and upload into it (if they are in a group that has Add/Upload perms).