I have created custom user role with the following:
add_role('customer', 'Customer', array( 'read' => true, 'edit_posts' => false, 'delete_posts'=> false, 'read_private_posts' => true ));
I then created a custom post type, added a post to the custom post type via the admin, uploaded image attachments and set the post to private. In the content of the post I link to an attachment page. On the front end, when logged in as an administrator user I can see the attachment page just fine. When logged in with a user account having the "customer" role I can view the private post just fine but trying to view the attachments to this private post return a 404 page.
Is this a core bug?