Anyone can build URL link (ITEM and KEY are easy to find) and see the whole request body - download attachments fe - without ANY AUTHORISATION!

I suppose it is the same error  or error-scheme found in mid 2010 and confirmed by support.

Lack of support in this case is really hard to tolerate.

Example:

https://sd_address/approval/Approve.jsp?ITEMID=31720&MODULE=Request&KEY=11327327904289 

If you've ever received ANY approval link/form (as requester) you can easily build another.