Files restricted to rooms: Errors are unspecific for end users

Description:

This resolves around the feature "Restrict files to rooms' members".
If a member of a room forwards attachments to an uninvolved user, the attachments are displayed, but downloading them causes errors. Since they seem to hint to technical problems this way, they cause complains to administration.

Note: We use the german version of Rocket.Chat so the translation may be slightly off.

Steps to reproduce:

1. Turn on the feature setting "File Uploads > Restrict files to rooms' members"
2. Be a member of a room or private conversation.
3. Forward a video file to another users not in the room or conversation

Expected behavior:

A message instead of the attachment: You can not view this attachment because you are not a member of the original room.

Actual behavior:

The attachment shows in the chat with correct filesize, a botched preview and technical errors when downloading.

Server Setup Information:

• Version of Rocket.Chat Server: 8.7.0
• License Type: Starter
• Number of Users: 29
• Operating System: Debian Trixie 13
• Deployment Method: Debian bare
• Number of Running Instances: 1
• DB Replicaset Oplog: unknown
• NodeJS Version: v22.23.1
• MongoDB Version: 8.0.20 / wired tiger

Client Setup Information

• Desktop App or Browser Version: Happens in all variants (desktop, browser, iOS, android)

Additional context

Relevant logs:

80.153.60.245 - - [19/Aug/2026:16:43:24 +0200] "GET /file-upload/6a85bc554ba5ca116b928431/272422689.mp4 HTTP/2.0" 403 0 "https://talk.ams-gruppe.de/direct/6a45281752599e5af1056e19" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0" "-" 80.153.60.245 - - [19/Aug/2026:16:43:24 +0200] "GET /file-upload/6a85bc5a4ba5ca116b928433/PXL_20260819_132808755~2.mp4 HTTP/2.0" 403 0 "https://talk.ams-gruppe.de/direct/6a45281752599e5af1056e19" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0" "-" 80.153.60.245 - - [19/Aug/2026:16:43:24 +0200] "GET /file-upload/6a85bc554ba5ca116b928431/272422689.mp4 HTTP/2.0" 403 0 "https://talk.ams-gruppe.de/direct/6a45281752599e5af1056e19" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0" "-" 80.153.60.245 - - [19/Aug/2026:16:43:24 +0200] "GET /file-upload/6a85bc5a4ba5ca116b928433/PXL_20260819_132808755~2.mp4 HTTP/2.0" 403 0 "https://talk.ams-gruppe.de/direct/6a45281752599e5af1056e19" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0" "-" 80.153.60.245 - - [19/Aug/2026:16:44:20 +0200] "GET /file-upload/6a85bc554ba5ca116b928431/272422689.mp4 HTTP/2.0" 403 0 "https://talk.ams-gruppe.de/direct/6a45281752599e5af1056e19" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0" "-" 80.153.60.245 - - [19/Aug/2026:16:44:20 +0200] "GET /file-upload/6a85bc5a4ba5ca116b928433/PXL_20260819_132808755~2.mp4 HTTP/2.0" 403 0 "https://talk.ams-gruppe.de/direct/6a45281752599e5af1056e19" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0" "-" 80.153.60.245 - - [19/Aug/2026:16:44:20 +0200] "GET /file-upload/6a85bc5a4ba5ca116b928433/PXL_20260819_132808755~2.mp4 HTTP/2.0" 403 0 "https://talk.ams-gruppe.de/direct/6a45281752599e5af1056e19" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0" "-"

Start by reproducing the case with “File Uploads > Restrict files to rooms' members” enabled and inspect the /file-upload requests for a forwarded attachment. Trace how the forwarded attachment is rendered and how the 403 response is handled. Done means an uninvolved recipient sees a clear membership-related message instead of a broken preview and technical download errors.