How is your security set up?  Is it at the group and folder level or at the report and user level?  Best practice is at the group and folder level - i.e. all users are assigned to groups and groups (not users) are given access to folders.  Access rights are inherited from parent groups and folders unless the inheritance is explicitly turned off.

For the user who can't run the report, has the user been explicitly denied refresh access at a higher level than the report itself?  The other thing you can check is at the user's Application rights for Crystal to make sure the user has refresh rights at that level.

-Dell