Well, we're going to stay on topic and see why the permission system is allowing guests to see the attachment and patch it in the next release; but we'll need to find the cause first.
It's likely something minor such as a misplacement of a variable in the script.