E.g. http://www.wikimedia.it/index.php/File:IntervisteMantova2010.mp3 is restricted (log: http://www.wikimedia.it/index.php?title=Speciale:Registri&page=File%3AIntervisteMantova2010.mp3 ) but you can still download it from even as a logged out user: http://www.wikimedia.it/images/IntervisteMantova2010.mp3
This should be the problem mentioned here: http://www.mediawiki.org/wiki/Extension_talk:SimpleSecurity#Security_bug_for_files
Version: unspecified
Severity: major