   public OHttpSession getSession(final String iId) {
     acquireSharedLock();
     try {

       final OHttpSession sess = sessions.get(iId);
       if (sess != null)
         sess.updateLastUpdatedOn();
       return sess;

     } finally {
       releaseSharedLock();
     }
   }

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.