When clicking on a link to an attachment, if the user is not logged in (i.e. anonymous), they will first be taken to the Confluence login page. After logging in, instead of being able to view the attachment, the logged in user will see the 'Not Permitted' page. This happens regardless of whether or not the logged in user has permission to view the attachment.

At the login screen, the URL will always contain: os_destination=%2Fnotpermitted.action (the page which the user will be directed to after login)

There are no issues if the user is already logged in and has valid permissions.