Users with Read Access can Upload Files to Records

Overview

File upload permission to object records is automatically granted to users who have Read permission on that record.

Details

The permission to upload "Notes & Attachments" or "Files" to object records, such as Account or Contact, is granted if the user has Read access to that specific record.

• This is the system's default behavior in Salesforce.
• The permission to upload files to a record cannot be controlled individually on a per-record basis.
• Users with Read permission are able to upload files regardless of any additional sharing configurations.