        public User getUser() {
            return userId == null
                    ? User.getUnknown()
                    : User.getById(userId, true)
            ;
        }
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.