Some users are unable to download attachments

some users are unable to download attachments, even when for some people with apparently the same settings it is working. This is happening across multiple projeqtor versions for quite some time. The attachments are added as public. Any idea what could be the problem? The error log is:

2023-09-18 09:30:52.324 ***** ERROR ***** [V10.3.5] HACK ================================================================
2023-09-18 09:30:52.324 ***** ERROR ***** [V10.3.5] Try to hack detected
2023-09-18 09:30:52.324 ***** ERROR ***** [V10.3.5]  Source Code = checkValidAccessForUser() Reject for Ticket #653 - no 'read' right to this item
2023-09-18 09:30:52.324 ***** ERROR ***** [V10.3.5]  QUERY_STRING = class=Attachment&id=1000&csrfToken=
2023-09-18 09:30:52.324 ***** ERROR ***** [V10.3.5]  REMOTE_ADDR = redacted
2023-09-18 09:30:52.324 ***** ERROR ***** [V10.3.5]  SCRIPT_FILENAME = /var/www/html/tool/download.php
2023-09-18 09:30:52.324 ***** ERROR ***** [V10.3.5]  CONNECTED USER = #21 - redacted
2023-09-18 09:30:52.324 ***** ERROR ***** [V10.3.5]  === Trace Stack for last error ===
2023-09-18 09:30:52.324 ***** ERROR ***** [V10.3.5]  => /var/www/html/tool/projeqtor.php at line 1692 calling debugPrintTraceStack()
2023-09-18 09:30:52.324 ***** ERROR ***** [V10.3.5]  => /var/www/html/model/Security.php at line 377 calling traceHack()
2023-09-18 09:30:52.324 ***** ERROR ***** [V10.3.5]  => /var/www/html/tool/download.php at line 65 calling Security:checkValidAccessForUser()
2023-09-18 09:30:52.325 ***** ERROR ***** [V10.3.5]  ===

same error on 10.4.5. Is there another log or setting I can check?

2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5] HACK ================================================================
2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5] Try to hack detected
2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5]  Source Code = checkValidAccessForUser() Reject for Ticket #653 - no 'read' right to this item
2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5]  QUERY_STRING = class=Attachment&id=999&csrfToken=
2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5]  REMOTE_ADDR = redacted
2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5]  SCRIPT_FILENAME = /var/www/html/tool/download.php
2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5]  CONNECTED USER = #21 - redacted
2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5]  === Trace Stack for last error ===
2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5]  => /var/www/html/tool/projeqtor.php at line 1700 calling debugPrintTraceStack()
2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5]  => /var/www/html/model/Security.php at line 377 calling traceHack()
2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5]  => /var/www/html/tool/download.php at line 65 calling Security:checkValidAccessForUser()
2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5]  ===
2023-09-21 13:00:59.871 ***** ERROR ***** [V10.4.5]  REQUEST_URI = /tool/download.php?class=Attachment&id=999&csrfToken=
 

Nevermind. We seem to have figured it out. The profile only had access to TicketMenuSimple and TicketMenu was "noaccess". But the download for the attachment, even when clicked from TicketMenuSimple, asks the permission function for TicketMenu and not TicketMenuSimple. So after changing the accessright table it seems to be working.