The Policy Admin Tool in Apache Ranger prior to 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API.
apache ranger