  public OHttpSession getSession(final String iId) {
    acquireSharedLock();
    try {

      final OHttpSession sess = sessions.get(iId);
      if (sess != null)
        sess.updateLastUpdatedOn();
      return sess;

    } finally {
      releaseSharedLock();
    }
  }

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.