error on a published report

Users started receiving error - “Access to this content denied based on report_view ACLs” when opening published incident report link from email. The same users can open the report and underlying records without issue once they are already logged into the instance (or when impersonated), and admins are never affected. The error only appears on a “cold” click. Users have sn_incident_read role and itil role. Report is shared to 'Everyone' with public role and link is generated and shared with users. What could be the issue?