MyBB Community Forums

According to a code comment in attachment.php, this might be by design:

// No Permission page if user cannot view or download attachments in this forum (if not calling the thumbnail)
if(($forumpermissions['canview'] == 0 || $forumpermissions['candlattachments'] == 0) && !$mybb->input['thumbnail'])
{
	error_no_permission();
}

But I don't understand why thumbnails shouldn't be protected... :/

This would make more sense:

if($forumpermissions['canview'] == 0 || $forumpermissions['canviewthreads'] == 0 || ($forumpermissions['candlattachments'] == 0 && !$mybb->input['thumbnail']))

That way, only users who can view the thread can view the thumbnails.

Thank you for your bug report.

This bug has been fixed in our internal code repository. Please note that the problem will not be fixed here until these forums are updated.