In vBulletin I have seen this caused by cookie scoping issues. For example, you login from and browse the forum using "www" but the attachment is inlined using a different subdomain such that the login cookie is out of scope. Fixes in that situation include changing the URL or adjusting the cookie domain setting to work on the entire domain (.domain.com).
And this software, and the timing of when it was opened up, is a miracle for us. Had someone answered their phone yesterday I would have put a 3 figure deposit down on a IPB skin.