Any authenticated user can download invoice.
Go to the download link, and change the invoice id. Download proceeds.
Downloading/Viewing of invoices should be based on permissions set.
Active
Code
you can use this patch if a patch is needed while waiting for feedback