diff --git a/api/v1/routers/board.py b/api/v1/routers/board.py
index 73fa3ca7b..ede54f130 100644
--- a/api/v1/routers/board.py
+++ b/api/v1/routers/board.py
@@ -394,6 +394,7 @@ async def api_download_file(
     - **wr_id**: 게시글 아이디
     - **bf_no**: 첨부된 파일의 순번
     """
+    service.validate_download_access()
     service.validate_download_level()
     board_file = service.get_board_file()
     service.validate_point(board_file)
diff --git a/bbs/board.py b/bbs/board.py
index 6c622c67c..1b1f545f1 100644
--- a/bbs/board.py
+++ b/bbs/board.py
@@ -452,6 +452,7 @@ async def download_file(
     Returns:
         FileResponse: 파일 다운로드
     """
+    service.validate_download_access()
     service.validate_download_level()
     board_file = service.get_board_file()
     service.validate_point_session(board_file)
diff --git a/service/board/read_post.py b/service/board/read_post.py
index adf79c72a..ba90f8587 100644
--- a/service/board/read_post.py
+++ b/service/board/read_post.py
@@ -332,6 +332,13 @@ def validate_download_level(self):
         if not self.is_download_level():
             self.raise_exception(detail="다운로드 권한이 없습니다.", status_code=403)
 
+    def validate_download_access(self):
+        """첨부파일 다운로드 전 게시글 접근 권한(읽기/비밀글/댓글) 검증"""
+        self.block_read_comment()
+        self.validate_read_level()
+        # 다운로드 경로에서도 비밀글 접근 제어를 강제한다.
+        self.validate_secret()
+
     def get_board_file(self) -> BoardFile:
         """파일 정보 조회"""
         board_file = self.file_service.get_board_file(self.bo_table, self.wr_id, self.bf_no)