Summary:
Users with no permission to opportunities can see the documents attached to the opportunities
Symptoms:
This happens when a user has no permission to view opportunities
If an one of these opportunities has any documents they can be seen by the user as long as they have access to the documents for that company
Status:
This issue is currently with development and will be fixed in a future version of Sage CRM