A sandboxed application can receive access to a file selected through a system dialog without receiving permission to browse your entire home folder. That difference can explain why Open works for one document while a manually entered neighbouring path fails.

Begin with the exact installed Flatpak application and a harmless sample file. Confirm that the Linux account can open the sample outside the app, then use the application's normal Open dialog to select it. Record whether that route works before changing any permissions.

Separate selected access from general access

Flatpak documents portals that mediate access to resources outside the sandbox. Selecting a file through a supported portal chooser grants the application access to that selected resource. Static filesystem permissions are a different mechanism and can cover a directory or much broader parts of the host.

Not every application uses every portal. If the program's own browser cannot reach a location, check its documented integration rather than assuming the drive or account permissions are broken.

The flatpak info --show-permissions view can help inspect the intended installation's permissions. Read filesystem entries in context; this is not a complete list of every dynamic chooser grant. Keep the actual failing path and the successful chooser result alongside that inspection.

Choose the narrow workflow that works

For a single document, prefer the supported file-selection route when it meets the task. If the application genuinely needs a folder tree, ask its maintainer which access is required and whether a narrower directory or read-only grant is sufficient. Avoid granting all home or host access just to eliminate one error.

Test reading the selected document and, when required, saving a disposable edited copy. Confirm the save destination outside the app so a sandbox-local copy is not confused with the original project folder.

If the chooser route still fails, preserve the error and application identity for support. A useful diagnosis distinguishes account access, portal selection and static permission scope. Making every file visible is not the acceptance criterion; completing the intended operation with understood access is.

Sources: Flatpak documentation, Ubuntu documentation.