The Policy Admin Tool in Apache Ranger prior to 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
apache ranger