Any user that has (even partial) write
permissions on a work-item (internal user as a resource in the project resource
pool included) can upload document and attach it to the work-item.
I'll open a case on it and will keep you posted
once it's being fixed. Please send over your contact information to my email firstname.lastname@example.org