I was able to reproduce this and this does appear to be a bug. When I created a private document between users X and Y and copied the URL. Once I logged in with user Y, I too received the Unauthorized error. If you would like to be notified for when the bug will be resolved, feel free to create a case in your support group and link them this discussion and the bug JIVE-59031.
This will allow the support Engineer to be notified when the bug is resolved and they will contact you with the update.