char from_hex(char ch) {
    return (char)(isdigit(ch) ? ch - '0' : tolower(ch) - 'a' + 10);
}

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.