A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product.