Image attachment preview broken for event attendees

Steps to reproduce

1. Create an event
2. Upload some image attachments (JPG, PNG...)
3. Invite someone
4. Save the event
5. Observe the attachments list from the attendee's view

Expected behavior

The image preview should load correctly.

Organizer view:

Actual behavior

The preview is broken only in the attendee's view.

Calendar app version

5.1.3

CalDAV-clients used

dav, dovecot

Browser

Firefox 136.0.2

Client operating system

Linux Mint

Server operating system

Debian Linux

Web server

Apache

Database engine version

MariaDB

PHP engine version

PHP 8.3

Nextcloud version

30

Updated from an older installed version or fresh install

Updated from an older version

List of activated apps

Enabled:
  - activity: 3.0.0
  - calendar: 5.1.3
  - calendar_resource_management: 0.9.0
  - cloud_federation_api: 1.13.0
  - comments: 1.20.1
  - contacts: 7.0.6
  - contactsinteraction: 1.11.0
  - dashboard: 7.10.0
  - dav: 1.31.1
  - deck: 1.14.4
  - federatedfilesharing: 1.20.0
  - files: 2.2.0
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - jitsi: 0.19.0
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - notifications: 3.0.0
  - oauth2: 1.18.1
  - provisioning_api: 1.20.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - snappymail: 2.38.2
  - spreed: 20.1.6
  - systemtags: 1.20.0
  - tasks: 0.16.1
  - theming: 2.6.0
  - theming_customcss: 1.17.0
  - twofactor_backupcodes: 1.19.0
  - twofactor_totp: 12.0.0-dev
  - updatenotification: 1.20.0
  - user_external: 3.4.0
  - user_status: 1.10.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webhook_listeners: 1.1.0-dev
Disabled:
  - admin_audit: 1.20.0
  - encryption: 2.18.0
  - federation: 1.20.0 (installed 1.19.0)
  - files_external: 1.22.0
  - files_versions: 1.23.0 (installed 1.22.0)
  - notify_push: 0.7.0
  - testing: 1.20.0
  - user_ldap: 1.21.0
  - user_migration: 7.0.1
  - workflowengine: 2.12.0

Nextcloud configuration

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "log_type": "file",
        "logfile": "\/var\/log\/groupware\/groupware_s4.log",
        "loglevel": 0,
        "logdateformat": "F d, Y H:i:s",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "default_language": "pt",
        "default_locale": "pt_BR",
        "dbtype": "mysql",
        "overwrite.cli.url": "http:\/\/localhost",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "allow_local_remote_servers": true,
        "lost_password_link": "disabled",
        "simpleSignUpLink.shown": false,
        "updater.release.channel": "git",
        "upgrade.disable-web": true,
        "updatechecker": false,
        "has_internet_connection": false,
        "trashbin_retention_obligation": "auto,10",
        "knowledgebaseenabled": false,
        "profile.enabled": false,
        "allow_user_to_change_display_name": false,
        "auth.bruteforce.protection.enabled": false,
        "activity_expire_days": 30,
        "app.mail.verify-tls-peer": false,
        "auth.webauthn.enabled": false,
        "overwriteprotocol": "https",
        "appstoreenabled": false,
        "user_backends": [
            {
                "class": "\\OCA\\UserExternal\\IMAP",
                "arguments": [
                    "127.0.0.1",
                    143,
                    null,
                    null,
                    false,
                    false
                ]
            }
        ],
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": "0",
            "password": "***REMOVED SENSITIVE VALUE***",
            "dbindex": 0,
            "timeout": 1.5,
            "read_timeout": 1.5
        },
        "memcached_server": [
            "localhost",
            "\/tmp\/memcached.sock"
        ],
        "theme": "",
        "trusted_domains": [
            "localhost",
            "devlucas.internetcontrolada.com"
        ],
        "mail_smtpmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpauth": true,
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": true,
                "verify_peer": false,
                "verify_peer_name": false
            }
        },
        "version": "30.0.10.1",
        "maintenance": false,
        "session_lifetime": "86400",
        "remember_login_cookie_lifetime": "86400",
        "debug": true
    }
}

Web server error log

Log file

Browser log

Additional info

No response

No source files, tests, logs, or entry points are identified in the report. Reproduce the event with image attachments and an attendee account, then inspect the attendee view and browser network requests alongside the organizer view. Done means the attendee can see the image preview while the existing organizer behavior remains intact.