CVE-2016-0735 Apache Ranger Access Restriction Bypass
Authenticated users can bypass parent resource access restrictions due to mishandled exclude policies in Apache Ranger.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-0735?
CVE-2016-0735 is a high-severity missing authorization vulnerability in n/a, published on 11 Apr 2016. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.
Weakness: CWE-264
Which versions are affected by CVE-2016-0735?
2 open source packages ship an affected version, including org.apache.ranger:ranger. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.ranger:ranger Maven | From 0.5.0 | 0.5.2 |
org.apache.ranger:ranger Maven | From 0.5.0 | 0.5.2 |
Products include Apache Ranger.
How do I fix CVE-2016-0735?
Upgrade org.apache.ranger:ranger to 0.5.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2016-0735 being exploited?
There is no known exploitation of CVE-2016-0735 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-28672 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder
- CVE-2026-32227 Apache Ranger: SQL Injection vulnerability in lookup functionality
- CVE-2026-40920 Apache Ranger: Privilege Escalation via URL Parameter
- CVE-2026-42537 Apache Ranger: Remote Code Execution via JDBC URL Injection
- CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation
Sources
Also known as GHSA-22v7-w6c5-v4rr.