[FIX] Security bug accessing registrant attachment