{"id":"CVE-2016-0735","aliases":["EUVD-2022-1884","GHSA-22v7-w6c5-v4rr"],"status":"published","title":"Apache Ranger Access Restriction Bypass","description":"Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.01669,"percentile":0.76869,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2016-04-11T19:00:00Z","modified":"2026-06-17T00:38:07Z","fixes":[{"ecosystem":"Maven","package":"org.apache.ranger:ranger","fixed_in":["0.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.ranger:ranger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0"},{"fixed":"0.5.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.ranger:ranger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0"},{"fixed":"0.5.2"}]}]}],"products":[{"vendor":"apache","product":"ranger"}],"references":[{"url":"http://mail-archives.apache.org/mod_mbox/ranger-dev/201603.mbox/%3CD31EE434.14B879%25vel%40apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0735","tags":["advisory"]},{"url":"https://github.com/apache/ranger/commit/18f216d0201eab93daea0b57035f7e6e3280bcfd","tags":["web"]},{"url":"https://github.com/advisories/GHSA-22v7-w6c5-v4rr"},{"url":"https://github.com/apache/ranger","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2016-0735","description":"Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.","status":"published","published":"2016-04-11T19:00:00Z","modified":"2024-08-05T22:30:04.074Z","updated_at":"2026-11-02T14:33:37.446553Z"}],"euvd":[{"id":"EUVD-2022-1884","description":"Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.","status":"published","published":"2016-04-11T19:00:00Z","modified":"2024-08-05T22:30:04Z","updated_at":"2026-11-03T02:23:00.426765Z"}],"ghsa":[{"id":"GHSA-22v7-w6c5-v4rr","title":"Apache Ranger Access Restriction Bypass","description":"Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.","status":"published","published":"2022-05-17T03:56:54Z","modified":"2024-03-20T14:10:52Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:37:41.821668Z"}],"nvd":[{"id":"CVE-2016-0735","description":"Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.","status":"published","published":"2016-04-11T19:59:02.227Z","modified":"2026-06-17T00:38:07.19Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:23.795791Z"}],"osv":[{"id":"GHSA-22v7-w6c5-v4rr","title":"Apache Ranger Access Restriction Bypass","description":"Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.","status":"published","published":"2022-05-17T03:56:54Z","modified":"2024-03-20T14:10:51Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}