char *filter_printf(const char *filter, const char *user) {
  char *result = malloc(filter_result_len(filter, user, NULL));
  filter_result_len(filter, user, result);
  return result;
}

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.