OWASP Top 10 2021 shows access control still drives web risk

At a glance

What this is: The article explains how the OWASP Top 10 2021 reshuffled web application risk, with broken access control rising to the top and SSRF entering the list.

Why it matters: It matters because IAM, application security, and platform teams need to treat authorization, session handling, and request validation as governance problems, not just code defects.

By the numbers:

• Open Redirects account for 5% of all submissions on Intigriti’s platform.
• Improper Access Control makes up 4% of all submissions on Intigriti’s platform.
• XSS accounts for over 15% of all submissions on Intigriti’s platform.

👉 Read INTIGRITI’s analysis of the OWASP Top 10 2021 ranking and web risk shifts

Context

The OWASP Top 10 remains a useful shorthand for where application risk concentrates, but the 2021 ranking shows a deeper shift than a simple list update. Broken access control overtook older web issues because modern applications increasingly fail at authorisation boundaries, session handling, and object-level access, which are governance problems as much as code problems.

For identity teams, the important signal is that application security now overlaps directly with IAM, especially where user identity, tokens, and API permissions determine what an application can do. That overlap is where broken access control becomes a control design issue rather than a one-off bug class, and that is the typical state of most enterprise application portfolios.

Key questions

Q: What breaks when broken access control is treated as a purely application-layer issue?

A: Teams miss the service and token boundaries where authorization actually fails. In modern applications, privilege is often expressed through APIs, workload tokens, and internal calls, so a user-centric view leaves the real trust path unprotected. Security teams need to test where authorization is enforced, inherited, and bypassed across the application stack.

Q: Why does SSRF create more risk in cloud and microservices environments?

A: Cloud and microservices environments often rely on internal trust, short-lived services, and metadata or internal API access that is reachable only from within the network. SSRF can abuse that trust to pivot from a public endpoint into privileged internal resources. The risk rises when services are exposed to broad egress permissions or can reach control-plane endpoints without strong destination checks.

Q: How should security teams prove authorization controls are operating effectively?

A: Security teams should require evidence that access controls were active, monitored, and reviewed over time, not just documented once. That means linking rule changes, approvals, logs, and exception handling into a single audit trail. For application authorization, the control must be testable in production, because compliance depends on observed operation, not declared intent.

Q: How should organisations prioritise SSRF, cryptography, and access control remediation?

A: Start with controls that create the largest blast radius, especially broken access control and SSRF in internet-facing services. Then address cryptographic weaknesses that expose sensitive data or undermine trust in transit. Prioritisation should follow reach, privilege, and exploitability, not just vulnerability counts.

Technical breakdown

Broken access control now dominates because enforcement moved to the app layer

Broken access control means an application allows actions outside a user’s intended permissions. In modern architectures, that often shows up as missing object-level checks, insecure direct object references, token tampering, or API endpoints that trust the caller too much. The shift from monolithic apps to distributed services increases the number of places where authorisation must be enforced. If each service makes its own decision, consistency breaks quickly, especially when identity claims are reused across browsers, APIs, and microservices.

Practical implication: centralise authorisation logic and test object-level access paths, not just login flows.

Cryptographic failures are really key management and data-handling failures

Cryptographic failures are not simply about weak algorithms. They usually arise when keys are hard-coded, reused, transmitted insecurely, or protected inconsistently across environments. The OWASP reframing from sensitive data exposure to cryptographic failures is important because it moves attention from the symptom to the root cause. In practice, data exposure often happens when development teams treat encryption as a checkbox rather than a lifecycle control tied to key storage, rotation, transport security, and environment separation.

Practical implication: treat key lifecycle and transport protection as operational controls, not just cryptography decisions.

SSRF exposes internal services when servers trust user-supplied destinations

Server-Side Request Forgery happens when an application fetches a remote resource based on user input without validating the target. That can let attackers reach internal metadata services, bypass network segmentation, or probe restricted endpoints from the server’s network position. SSRF matters because it turns a benign fetch function into a control-plane bridge between untrusted input and trusted infrastructure. The risk grows in cloud environments where metadata endpoints and internal APIs are reachable from application workloads.

Practical implication: validate outbound destinations and restrict server-side egress to approved targets only.

NHI Mgmt Group analysis

Broken access control is an identity failure disguised as an application bug. When an app trusts a token, session, or object identifier without checking the caller’s true scope, the access decision is wrong even if authentication succeeded. That is why broken access control sits at the intersection of IAM and application security, not just OWASP testing. Practitioners should treat object-level authorisation as a core identity control, not an optional code review item.

SSRF shows how cloud exposure often begins with a single untrusted request path. The underlying failure is not simply input validation. It is the assumption that a server can safely decide where to connect because it is inside the trusted network boundary. In cloud-native estates, that assumption breaks quickly when metadata services, internal APIs, and service-to-service trust are reachable from application code.

Security misconfiguration and vulnerable components keep rising because configurability expands the attack surface. Modern frameworks reduce some classes of bespoke authentication logic, but they increase dependence on defaults, flags, middleware, and third-party modules. That means security now depends on lifecycle governance, version hygiene, and deliberate hardening. The practitioner takeaway is that secure code is not enough if the deployed configuration drifts.

OWASP’s 2021 reshuffle is a reminder that risk follows architectural change, not just attacker novelty. XSS and injection still matter, but the more urgent governance issue is that identity, data access, and application trust are now distributed across more services and more teams. Security programmes should align testing, authorisation design, and developer training to the way systems are actually built.

Named concept: authorisation drift. This is the gap between where a permission was intended to apply and where an application actually enforces it. It appears when microservices, APIs, and object identifiers create inconsistent control points. The only durable response is continuous validation of access rules across the full request path.

What this signals

Broken access control and SSRF are not just application defects. They are signs that authorisation, request validation, and trust boundaries have outgrown the way many programmes govern identity and access.

Authorisation drift: this is the operational gap created when access checks are implemented inconsistently across services, APIs, and tenants. Teams should pair application testing with identity lifecycle controls, because OAuth-connected services and service accounts create the same kind of invisible trust expansion that the [NHI Lifecycle Management Guide](https://nhimg.org/nhi-lifecycle-management-guide) is meant to govern.

For identity-heavy application estates, the next step is not broader scanning alone. It is tighter alignment between IAM, application security, and API governance so that permissions are designed, tested, and revoked as a single control plane.

For practitioners

• Harden object-level authorisation checks Map every high-risk API and workflow to an explicit access rule, then test whether users can access another user’s records, actions, or tenant data through alternate identifiers.
• Validate server-side outbound requests Restrict application egress to approved destinations, block access to metadata services by default, and review any endpoint that fetches remote URLs from user input.
• Treat encryption as a lifecycle control Inventory hard-coded keys, plaintext transmission paths, and weak key storage, then assign ownership for rotation, revocation, and transport protection across environments.
• Rebalance testing toward current attack patterns Shift developer training and security testing toward access control, SSRF, misconfiguration, and dependency risk, while keeping legacy injection coverage in place.

Key takeaways

• Broken access control is the standout lesson from OWASP Top 10 2021 because authorisation failures now define more real-world exposure than many classic web flaws.
• The ranking also shows that SSRF, cryptographic failures, and misconfiguration are governance problems, not isolated coding mistakes.
• Security teams should shift testing and training toward access paths, outbound request controls, and configuration discipline across the application lifecycle.

Key terms

• Broken Access Control: Broken access control occurs when a system fails to restrict what an authenticated user, service, or workload can do. The issue often appears as missing checks, inconsistent enforcement, or excessive permissions. It is a structural weakness because attacks exploit the gap between verified identity and permitted action.
• Server-Side Request Forgery: An attack pattern where a vulnerable server is tricked into making requests on the attacker’s behalf. In application exploitation, SSRF can be used to reach internal resources, fetch malicious payloads, or amplify a flaw into full code execution.
• Permission Drift: Permission drift is the gradual expansion of access beyond what was originally intended. It happens when roles, tokens, and service accounts accumulate unused rights over time, making cloud identities harder to review and more dangerous to compromise.
• Cryptographic Failure: A weakness in how data is protected in transit or at rest, usually caused by bad key management, exposed secrets, or inconsistent enforcement rather than weak algorithms alone. It matters because strong encryption can still fail when the credentials behind it are poorly governed.

What's in the full article

INTIGRITI's full article covers the OWASP category-level detail this post intentionally leaves for the source:

• Submission-rate breakdowns for each OWASP category, useful if you are benchmarking your own testing focus against community findings.
• The category-by-category explanation of why Broken Access Control replaced older top risks, including examples of API misuse and token tampering.
• The article’s discussion of how framework adoption changes the shape of security work for researchers and development teams.
• The source’s commentary on which vulnerabilities researchers should prioritise next as web attack patterns evolve.

👉 INTIGRITI’s full article breaks down the category changes, submission data, and implications for researchers and companies.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, workload identity, and identity lifecycle controls. It helps practitioners connect application trust decisions to the access and lifecycle issues that shape modern security programmes.