   public OHttpSession[] getSessions() {
     acquireSharedLock();
     try {

       return (OHttpSession[]) sessions.values().toArray(new OHttpSession[sessions.size()]);

     } finally {
       releaseSharedLock();
     }
   }

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.