In tangro Business Workflow prior to 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authenticated.
tangro business workflow