Users running a non-download version of Vanilla (pulled from github), on branch release/2019.016 or master from the last 2 weeks should upgrade to release/2019.017 or latest master for security reasons. Downloaded official open sources releases are not affected.
Allow guests to download
This discussion is related to the fileupload addon.
If you want guests to be able to download attachments from the File Upload plugin, you can make one small change to the database. I have not had any unwanted side effects with this so far. Here's the SQL to grants guests download permission:
UPDATE `YOUR_DATABASE_NAME_HERE`.`GDN_Permission` SET `Plugins.Attachments.Download.Allow` = '1' WHERE `GDN_Permission`.`PermissionID` =2;