One of the 10k privileges is the ability to see reviews by other users in the review history pages, e.g. https://meta.stackexchange.com/review/close/history. (With less reputation, you only see your own reviews – a low-rep user can't make much use of the page unless they previously had enough reputation to review.)
However, reviews are accessible, even to logged-out users, if they know the URL of the review. Review URLs follow a fairly predictable pattern, with reviews being given consecutive numbers, so if you want to find out what reviews have been happening recently, you can do so simply via URL enumeration: you can try a review number in every review queue until you find the appropriate URL, and work out what the "current" review number is via bisection. This is an approach which I've used when I'm curious about what the current state of reviewing is on exchanges where I don't have much reputation.
This seems like a problem, though, regardless of whether or not the information is meant to be publicly available:
- If the information is not meant to be publicly available, then the ability for logged-out users to access it means anyway that something has gone wrong with the security behind the site.
- If the information is meant to be publicly available (and I can't think of a reason to hide it – being able to see what reviewers are up to may well be a good way of learning how to use the review queues correctly), the current method of accessing it creates a lot of extra server load for both the viewer, and for Stack Exchange (because there are multiple review queues, and lots of network round-trips are wasted by incorrectly guessing which queue a review will belong to, and many more trying to figure out what the most recent review number is).
Probably, most low-reputation users aren't trying to read the review history anyway, but the current situation is unsatisfactory when they do (and there are plenty of people who have high reputation on some Stack Exchange sites and low reputation on others, so there will be plenty of low-rep users who know that the review history page exists).
It's unclear what the best way to fix the inconsistency is – making the review history page work via direct URL entry (without linking it anywhere) would almost be the simplest fix, but the same URL is used for the "view your reviews" page as for the "view everyone's reviews" page, which complicates things a lot because users can access the page itself before they hit 10k reputation but are only "supposed" to be able to access half its content. Perhaps this shouldn't be a 10k privilege – it's unclear why 10k users would find the information more useful than lower-reputation users (as there isn't really much they can do about it).
