static int match_word(const char *word, char **list)
{
	int n;
	for (n=0; list[n]; n++)
		if (cmd_match(word, list[n]))
			break;
	return n;
}

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.