In JetBrains YouTrack prior to 2020.4.4701, permissions for attachments actions were checked improperly.
jetbrains youtrack