Very odd problem. I have a bundle where a user uploads a file to a private file field. When viewing the bundle; they see the file listed and can see it is linked to the file; but when clicking the file, they get Access Denied. This is on a CentOS 7 server.
The part which makes this odd is that the site is version controlled and the same code is running on my local Windows development machine. I just grabbed a copy of the server db and installed on my local. So, technically, the sites should be identical. On my local, the user is able to view the private file.
Normally this would lead me to think it is a server issue; but, anyone with Administrator role can view the file. This suggests it is something controlled by Drupal.
On the server I have created a virgin bundle with only a single new file field; and the problem persists. So it appears to not be bundle or site config related.