Log in as a Confluence administrator, click "Confluence Administration"> "Page and Attachment Security Enhancer"> "Configuration", and select "Attachment Upload Restrictions".
The default of the 3 switches: on.
"Attachment types that need to be restricted when uploading attachments via a web browser or Rest Api" default is: empty (no restrictions).