i removed the space key from the URL for the normal space attachment viewing, and it displays all the attachments for all spaces in the install of Confluence, Irrispecitve of space and page level permission restrictions.

For Example:
http://confluence.atlassian.com/spaces/listattachmentsforspace.action

while this does not allow people to download the files, it does give people the name of the files, the location and the page they are attached to.

Could this be patched ASAP!

We will be blocking the URL through our Apache install for the moment until this is rectified.

Thanks.