Cannot attach media when capabilities added to custom post type

You have assigned custom capabilities to post type, but did you assigned these capabilities to user roles or users? This is not done automatically, and adding custom caps to post types doesn’t add those caps to the roles or users. You have two solutions:

  1. Register post type without the ‘capabilities’ options, and it will fall back to default capabilities used by posts or pages.
  2. Use some User Roles editor plugin to assign these new ‘vendor’ based capabilities to user roles you want to allow using them.