Notifications
Clear all
Topic starter
20/08/2026 6:10 pm
TL;DR: Access control flaws, API leakage, and XSS remained high-impact failure points in 2024 software security, with examples ranging from IDOR-style resource abuse to exposed password reset tokens and admin session hijacking, according to INTIGRITI. The practical lesson is that software security still breaks at the intersection of identity, permissions, and exposed attack surface.
NHIMG editorial — based on content published by INTIGRITI: Software industry: Top vulnerabilities in 2024 and what to watch for in 2025
By the numbers:
- 94% of organizations had experienced security problems in production APIs, and 17% had experienced an API-related breach.
- XSS accounted for 10.5% of all high and critical vulnerabilities in 2023 and required an average of 100 man-days to remediate.
- The average cost of a cyber breach in 2024 was $4.88 million, according to Intigriti’s analysis.
Questions worth separating out
A: Start with technical severity, then re-rank issues that sit on privileged accounts, externally reachable apps, or business-critical workflows.
Q: Why do access control bugs create such large breach risk in SaaS applications?
A: SaaS applications concentrate sensitive data and workflows behind shared APIs, so a single authorization mistake can expose many records or tenants at once.
Q: What do teams get wrong about API security and information leakage?
A: Teams often focus on authentication while overlooking response content.
Practitioner guidance
- Re-test authorization at the object level Verify every sensitive API and UI action with server-side authorization checks, especially where the same record can be viewed, edited, or deleted by different roles.
- Minimise API responses to transaction need Remove reset tokens, internal identifiers, and any field not essential to the user’s immediate action.
- Prioritise privileged workflows for XSS testing Run targeted testing against admin, support, and employee-facing workflows where a browser session can unlock internal tools or sensitive records.
What's in the full article
INTIGRITI's full blog post covers the operational detail this post intentionally leaves for the source:
- The researcher examples behind the access control, API leakage, and XSS findings, including how each flaw was exercised in practice.
- The article’s practical advice on dynamic testing beyond scanners, especially where SaaS workflows and privileged users are involved.
- The prevention tips for shift-left security, bug bounty expansion, and supply chain readiness that implementation teams can action.
- The broader 2025 prioritisation guidance for cloud, SaaS, and third-party dependencies.
👉 Read INTIGRITI's analysis of the top software vulnerabilities in 2024 →
Access control, APIs, and XSS: what software teams missed in 2024?
Explore further
20/08/2026 6:46 pm
Access control debt is the hidden identity risk inside application security. The article shows that many so-called software bugs are really failures to enforce who can act on what. That is an IAM problem as much as an application problem, because RBAC only works when server-side authorization is consistent across every object, workflow, and API. Teams should treat authorization drift as governance debt, not just a code defect.
A question worth separating out:
Q: How can organizations reduce the risk of XSS in privileged workflows?
A: They should test every privileged browser path, especially admin and support tools, and enforce output encoding, input validation, and a restrictive Content Security Policy. XSS becomes far more damaging when it lands in a session with elevated access, so the control objective is to prevent script execution where trusted users can reach sensitive functions.
👉 Read our full editorial: Software vulnerabilities in 2024 exposed RBAC, API, and XSS gaps
