To view (download) attachments linked to a specific feature the accessing user must have Read (0) permission on that feature.

To modify (create or delete) attachments linked to a specific feature the accessing user must have Modify (1) permission on that feature.