Reported by Stanford (CW-2699). Here is the step to reproduce this:
1. Go to "My Workspace", then Worksite Setup, then "New".
2. Select and enter the necessary information.
3. In the Project Site Tools page, include "Tests & Quizzes" and select "Yes" to re-use material from another site (please make sure there is at least one assessment in the "from site" has attachments).
4. Create the site.
5. Login as another user (not admin or super use who has privilege to view all). Go to Tests & Quizzes tool of newly created site.
6. Try to view the attachment. You will get a 403 access forbidden error. If you view the URL of that attachment, it will be something like: http://localhost:8080/access/content/attachment/~3aefb853-d96a-4f93-a8da-87bd5b7773ae/Tests%20_%20Quizzes/ba8c1548-ab3e-46a3-a791-4f7ffd0dc506/images.jpg. The "~3aefb853-d96a-4f93-a8da-87bd5b7773ae" is the creator's My Workspace Site Id.
You should be able to view the attachment. The URL should look like: http://localhost:8080/access/content/attachment/3600f8b8-de49-466e-8765-cf2e746ee4f9/Tests%20_%20Quizzes/8c4164d8-4b88-44f7-9acd-03d9e11d11bc/images.jpg. The "3600f8b8-de49-466e-8765-cf2e746ee4f9" is the new site Site Id.