Hidden pages' content can be viewed without permission using diffpages.action

If the id of a page is known by a user, that user can view the content of the page without having permissions to the space it is in. They need only construct the right URL.
EG:
Two spaces A and B
Page with id 1 is in Space A
Page with id 2 is in Space B
User cannot see Space A
User can see Space B

The following URL will allow the user to view a diff of the two pages, thus easily deriving the content of the page in the hidden space.

http://confluence.example.com/pages/diffpages.action?pageId=2&originalId=1