If a user knows the name of a page they can move attachments to that page by setting the "Page" field when editing the attachment. This can be done even when the page has "view restrictions" applied that prevent the user seeing the page. The attachment would then be inaccessible for that user.

This is related to [CONF-9374], which is the same issue for moving pages to inaccessible places