Reply to thread

Permissions are checked in the attachment handler. Can you send me a link to an attachment I shouldn't be able to see?

I'd also recommend confirming with an incognito browser session (not logging out) and with add-ons disabled. Attachments are fairly strongly cached so logging out may still trigger the cache.