This is a very old attack vector that seems to come again and again. If you ever find yourself using “codes” to access private content. You better make them closer to a sha1 hash than a short URL.