You will most likely be dealing with either Object-Level Security or Record-Level Security.
As a first step: Check that the profile of the user has access to attachments and then check the Role relationship between the user and the owner of the attachment.
Object-Level Security (Permission Sets and Profiles)
If this was restricting the "regular Salesforce user" from accessing attachments then they wouldn't be able to access any attachment records, regardless of who created the.
Object-level security—or object permissions—provide the bluntest way to control data. Using object permissions you can prevent a user from seeing, creating, editing, or deleting any instance of a particular type of object, such as a lead or opportunity. Object permissions let you hide whole tabs and objects from particular users, so that they don’t even know that type of data exists.
Field-Level Security (Permission Sets and Profiles)
FLS is unlikely to be the issue here. If that was the case, the user could access the attachments, but would not be able to see certain fields.
Record-Level Security (Sharing)
Record level security is at the actual record level.
Every record is owned by a user or a queue. The owner has full access to the record. In a hierarchy, users higher in the hierarchy always have the same access to users below them in the hierarchy. This access applies to records owned by users, as well as records shared with them.
Have a read through Securing Data Access