Notifications
Clear all
Topic starter
21/08/2026 4:55 pm
TL;DR: OWASP Top 10 2021 puts broken access control back at number one, adds SSRF, and reframes cryptographic failures and insecure design around the controls practitioners keep missing, according to INTIGRITI’s analysis. The ranking shows why identity-aware authorization, session control, and secure-by-design practices now matter as much as scanning for classic injection flaws.
NHIMG editorial — based on content published by INTIGRITI: The new OWASP Top 10 by 2021
By the numbers:
- Open Redirects account for 5% of all submissions on Intigriti’s platform.
- Improper Access Control makes up 4% of all submissions on Intigriti’s platform.
- XSS accounts for over 15% of all submissions on Intigriti’s platform.
Questions worth separating out
Q: What breaks when broken access control is treated as a purely application-layer issue?
A: Teams miss the service and token boundaries where authorization actually fails.
Q: Why does SSRF create more risk in cloud and microservices environments?
A: Cloud and microservices environments often rely on internal trust, short-lived services, and metadata or internal API access that is reachable only from within the network.
Q: How should security teams prove authorization controls are operating effectively?
A: Security teams should require evidence that access controls were active, monitored, and reviewed over time, not just documented once.
Practitioner guidance
- Harden object-level authorisation checks Map every high-risk API and workflow to an explicit access rule, then test whether users can access another user’s records, actions, or tenant data through alternate identifiers.
- Validate server-side outbound requests Restrict application egress to approved destinations, block access to metadata services by default, and review any endpoint that fetches remote URLs from user input.
- Treat encryption as a lifecycle control Inventory hard-coded keys, plaintext transmission paths, and weak key storage, then assign ownership for rotation, revocation, and transport protection across environments.
What's in the full article
INTIGRITI's full article covers the OWASP category-level detail this post intentionally leaves for the source:
- Submission-rate breakdowns for each OWASP category, useful if you are benchmarking your own testing focus against community findings.
- The category-by-category explanation of why Broken Access Control replaced older top risks, including examples of API misuse and token tampering.
- The article’s discussion of how framework adoption changes the shape of security work for researchers and development teams.
- The source’s commentary on which vulnerabilities researchers should prioritise next as web attack patterns evolve.
👉 Read INTIGRITI’s analysis of the OWASP Top 10 2021 ranking and web risk shifts →
Broken access control and SSRF: what app security teams need to know?
Explore further
21/08/2026 5:12 pm
Broken access control is an identity failure disguised as an application bug. When an app trusts a token, session, or object identifier without checking the caller’s true scope, the access decision is wrong even if authentication succeeded. That is why broken access control sits at the intersection of IAM and application security, not just OWASP testing. Practitioners should treat object-level authorisation as a core identity control, not an optional code review item.
A question worth separating out:
Q: How should organisations prioritise SSRF, cryptography, and access control remediation?
A: Start with controls that create the largest blast radius, especially broken access control and SSRF in internet-facing services. Then address cryptographic weaknesses that expose sensitive data or undermine trust in transit. Prioritisation should follow reach, privilege, and exploitability, not just vulnerability counts.
👉 Read our full editorial: OWASP Top 10 2021 shows access control still drives web risk
