diff --git a/addons/website_mail_channel/controllers/main.py b/addons/website_mail_channel/controllers/main.py
index 37dd899b3fc..143b6f08e37 100644
--- a/addons/website_mail_channel/controllers/main.py
+++ b/addons/website_mail_channel/controllers/main.py
@@ -175,8 +175,19 @@ class MailGroup(http.Controller):
             base_domain = [('model', '=', 'mail.channel'), ('res_id', '=', group.id)]
         next_message = Message.search(base_domain + [('date', '<', message.date)], order="date DESC", limit=1) or None
         prev_message = Message.search(base_domain + [('date', '>', message.date)], order="date", limit=1) or None
+
+        # handle access to attachments for public / portal
+        if request.env.user.has_group('base.group_user'):
+            attachments = message.attachment_ids
+        else:
+            # portal / external people cannot access attachments -> grant access
+            # as message is ok, generate access tokens
+            attachments = message.sudo().attachment_ids
+            attachments.generate_access_token()
+
         values = {
             'message': message,
+            'attachments': attachments,
             'group': group,
             'mode': mode,
             'archives': self._get_archives(group.id),
diff --git a/addons/website_mail_channel/views/website_mail_channel_templates.xml b/addons/website_mail_channel/views/website_mail_channel_templates.xml
index 4e247afd621..fe88c9e9d7f 100644
--- a/addons/website_mail_channel/views/website_mail_channel_templates.xml
+++ b/addons/website_mail_channel/views/website_mail_channel_templates.xml
@@ -202,20 +202,28 @@
                             <div t-raw="message.body"/>
 
                             <div>
-                                <p t-if="message.attachment_ids" class="mt8">
+                                <p t-if="attachments" class="mt8">
                                     <a href="#" class="o_mg_link_hide">
-                                        <i class="fa fa-chevron-right" role="img" aria-label="Hide attachments" title="Hide attachments"/> <t t-raw="len(message.attachment_ids)"/> attachments
+                                        <i class="fa fa-chevron-right" role="img" aria-label="Hide attachments" title="Hide attachments"/> <t t-raw="len(attachments)"/> attachments
                                     </a>
                                     <a href="#" class="o_mg_link_show">
-                                        <i class="fa fa-chevron-down" role="img" aria-label="Show attachments" title="Show attachments"/> <t t-raw="len(message.attachment_ids)"/> attachments
+                                        <i class="fa fa-chevron-down" role="img" aria-label="Show attachments" title="Show attachments"/> <t t-raw="len(attachments)"/> attachments
                                     </a>
                                 </p>
                                 <div class="o_mg_link_content">
-                                    <div class="col-lg-2 col-md-3 text-center" t-foreach='message.attachment_ids' t-as='attachment'>
-                                        <a t-attf-href="/web/content/#{attachment.id}?download=true" target="_blank">
-                                            <div class='oe_attachment_embedded o_image' t-att-title="attachment.name" t-att-data-mimetype="attachment.mimetype" t-attf-data-src="/web/image/#{attachment.id}/100x80"/>
-                                            <div class='oe_attachment_name'><t t-raw='attachment.name' /></div>
-                                        </a>
+                                    <div class="col-lg-2 col-md-3 text-center" t-foreach='attachments' t-as='attachment'>
+                                        <t t-if="attachment.access_token">
+                                            <a t-attf-href="/web/content/#{attachment.id}?download=true&amp;access_token=#{attachment.access_token}" target="_blank">
+                                                <div class='oe_attachment_embedded o_image' t-att-title="attachment.name" t-att-data-mimetype="attachment.mimetype" t-attf-data-src="/web/image/#{attachment.id}/100x80"/>
+                                                <div class='oe_attachment_name'><t t-raw='attachment.name' /></div>
+                                            </a>
+                                        </t>
+                                        <t t-else="">
+                                            <a t-attf-href="/web/content/#{attachment.id}?download=true" target="_blank">
+                                                <div class='oe_attachment_embedded o_image' t-att-title="attachment.name" t-att-data-mimetype="attachment.mimetype" t-attf-data-src="/web/image/#{attachment.id}/100x80"/>
+                                                <div class='oe_attachment_name'><t t-raw='attachment.name' /></div>
+                                            </a>
+                                        </t>
                                     </div>
                                 </div>
                             </div>