Problem:
The first page of a document is publicly accessible having the link to the thumbnail. The link has an access_token in it and with it, it is even possible to download the whole document.
To prevent data leak, please leave the thumbnails on the tenant and not on a public accessible "westeurope1-mediap.svc.ms/transform/thumbnail" server with a deeplink to the file.
In the past weeks we learned on the news that simple browser plug-ins can send these links to other servers. So the risk for leaking these links and finally sensitive data is huge.
If it is not possible to leave thumbnails on the tenant, consider making it possible to opt-out from this feature in the admin pages.
Till then, only thing to do is using always a coverpage as a first page in a document. Don't take pictures with sensitive data on them. But having done all this, the access_token in the link will not prevent from someone obtaining the link to download the whole document.
I did not test for how long the token is valid.
Examples of places i tested that make this thumbnail files:
1. Internal (not shared) document on a SharePoint site:
2. Personal OneDrive folder.
3. Personal OneDrive folder image upload.
4. To my surprise the problem extends also to outlook.office.com
Screenshots as I cannot post links with the access_token in them:
1. https://dc704.4shared.com/img/p7LskMDPfi/s25/16c491b6d70/1_online?isRedirect=true&
2. https://dc704.4shared.com/img/oA-Ns4slda/s25/16c491b65a0/3_online?isRedirect=true&
3. https://dc704.4shared.com/img/oA-Ns4slda/s25/16c491b65a0/3_online?isRedirect=true&
4. The thumbnail link from outlook expires after a short amount of time, but still, it's ridiculous.
You can test it yourself in any browser. See on the following screenshot where to find the deeplink: https://dc593.4shared.com/img/1KkldLRxda/s25/16c49307440/How_To_Get_Thumbnail?isRedirect=true&
Links look like this:
https://westeurope1-mediap.svc.ms/transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=h...___DOMAIN___.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!m2Xa-PkPGke3NksFN2FU01Ff_pxP-AJMik3hXghVjYkmGmeNmVF9SLq9eRUEzFx0%2Fitems%2F01WTLDZYGDSBIX3KG5C5DKNAVEAR3G2262%3Fversion%3DDraft&access_token=______TOKEN_______&encodeFailures=1&srcWidth=&srcHeight=&width=2000&height=2000&action=Preview
https://attachments.office.net/owa/____MAILBOX_____/service.svc/s/GetAttachmentThumbnail?id=
