Look for this setting in Web.config and copy it to your user.config:
<add key="RolesThatCanUploadAndBrowse" value="Admins;Content Administrators;Content Publishers;Content Authors;Store Managers;" />
modify it like this:
<add key="RolesThatCanUploadAndBrowse" value="Authenticated Users;" />
All users get added by default to the Authenticated Users role, so all forum users will be able to upload images. The images wil be stored on disk at /Data/Sites/[SiteID]/userfiles/[UserGuid]/
so users can not browse the general file system and can only see files they upload themselves.