While setting up category's ACL you need to tickle all the user's group. All / None links are not working.
At console you will find at least 3 errors related to ed js - see screenshot attached.
Your assistance is more than appreciated.
Attachments can only be downloaded by logged in users