  def setup_user
    @request.session[:user] = users(:one).id
    users(:one).roles       = [Role.default, Role.find_by_name('Viewer')]
  end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.