I have created custom user role with the following:
add_role('customer', 'Customer', array(
'read' => true,
'edit_posts' => false,
'delete_posts'=> false,
'read_private_posts' => true
));
I then created a custom post type, added a post to the custom post type via the admin, uploaded image attachments and set the post to private. In the content of the post I link to an attachment page. On the front end, when logged in as an administrator user I can see the attachment page just fine. When logged in with a user account having the "customer" role I can view the private post just fine but trying to view the attachments to this private post return a 404 page.
Is this a core bug?