404 page for attachments on private posts

I have created custom user role with the following:

add_role('customer', 'Customer', array(
			'read'        => true,
			'edit_posts'  => false,
			'delete_posts'=> false,
			'read_private_posts' => true
		));

I then created a custom post type, added a post to the custom post type via the admin, uploaded image attachments and set the post to private. In the content of the post I link to an attachment page. On the front end, when logged in as an administrator user I can see the attachment page just fine. When logged in with a user account having the “customer” role I can view the private post just fine but trying to view the attachments to this private post return a 404 page.

Is this a core bug?