Topic starter
21/08/2026 4:55 pm
TL;DR: OWASP Top 10 2021 puts broken access control back at number one, adds SSRF, and reframes cryptographic failures and insecure design around the controls practitioners keep missing, according to INTIGRITI’s analysis. The ranking shows why identity-aware authorization, session control, and secure-by-design practices now matter as much as scanning for classic injection flaws.
Editorial analysis by NHI Mgmt Group, based on content published by INTIGRITI: “The new OWASP Top 10 for 2021”.
By the numbers:
- Open redirects account for 5% of all submissions on Intigriti’s platform.
- Improper access control accounts for 4% of all submissions on Intigriti’s platform.
- Improper authentication accounts for 4% of all submissions on Intigriti’s platform.
Key questions
Q: What breaks when broken access control is not enforced server-side?
A: When access control is only checked in the UI or at login, attackers can call protected APIs, change object identifiers, or invoke functions they should never reach.
Q: Why does SSRF create such a large security impact even when it is relatively uncommon?
A: SSRF is dangerous because it lets an attacker use the server as a proxy into internal systems.
Q: What do security teams get wrong about authentication controls and trust?
A: They often assume that operating a control is the same as controlling trust.
Practitioner guidance
- Tighten object and function authorization checks Review endpoints for missing server-side authorization on every object and action, especially POST, PUT, delete, and admin functions.
- Constrain SSRF-prone outbound requests Restrict which hosts, schemes, and destinations applications can call, and isolate access to internal services and metadata endpoints from user-controlled requests.
- Rework authentication into session and scope control Verify that logged-in users can only access their own records and approved functions, and that token claims are enforced by the server rather than trusted from the client.
Bottom line: Broken access control remains the most persistent web application risk because it combines authorization gaps, session weakness, and token abuse in one failure mode.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:12 pm
Broken access control is now a governance problem, not just a code defect. The article’s examples show that authorization failures span APIs, tokens, object references, and session logic. That means identity proof is not the same as permission proof, which is where many application programmes still over-assume safety. Security teams should treat authorization scope as a first-class control objective.
A question worth separating out:
Q: How should organisations balance vulnerability scanning with secure-by-design reviews?
A: Scanning remains useful, but it cannot find every trust failure embedded in architecture, dependency handling, or release pipelines. Secure-by-design review is needed to catch flaws such as missing authorization boundaries, unsafe request handling, and unverified integrity controls before they become repeatable production risk.
👉 Read our full editorial: OWASP Top 10 2021 shows access control still drives web risk