Summary:

Users with no permission to opportunities can see the documents attached to the opportunities

Symptoms:

This happens when a user has no permission to view opportunities

If an one of these opportunities has any documents they can be seen by the user as long as they have access to the documents for that company

Status:

This issue is currently with development and will be fixed in a future version of Sage CRM