Redmine

Attachments are protected data and thus must not be publicly available without authentication. This is ensured by Redmine's authorization rules. If this would not be the case, we would consider it a high-severity security issue.

In general, the visibility of attachments is governed by their attached objects (i.e. issues in this case), so that the attachment is visible if the issue is visible to the current user. Thus, users can download attachments if the issue itself is publicly available (i.e. is in a public project in a Redmine which does not enforce authentication) or if the user is logged into Redmine from their current browser / mail client.