Unexpected behaviour: Uploaded images are accessible for everyone

When I upload an image (stored on the server itself) the image is not protected like the *.md-file is.
I understand the problem to keep another access-level for each image but if I mark a note as private I also expected the pictures to be private only. In fact I can even access them without being logged in just by having the URL.