Topic starter
21/08/2026 4:55 pm
TL;DR: Broken access control returns to the top of OWASP Top 10 2021, while SSRF enters the list, INTIGRITI reports. Web apps now need stronger authorization boundaries and safer request handling to keep trusted traffic from becoming an attack path.
Editorial analysis by NHI Mgmt Group, based on content published by INTIGRITI: “The new OWASP Top 10 for 2021”.
By the numbers:
- Open redirects account for 5% of all submissions on Intigriti’s platform.
- Improper access control accounts for 4% of all submissions on Intigriti’s platform.
- Improper authentication accounts for 4% of all submissions on Intigriti’s platform.
Key questions
Q: Why does SSRF create such a large security impact even when it is relatively uncommon?
A: SSRF is dangerous because it lets an attacker use the server as a proxy into internal systems.
Q: What do security teams get wrong about authentication controls and trust?
A: They often assume that operating a control is the same as controlling trust.
Q: What breaks when broken access control is not enforced server-side?
A: When access control is only checked in the UI or at login, attackers can call protected APIs, change object identifiers, or invoke functions they should never reach.
Practitioner guidance
- Tighten object and function authorization checks Review endpoints for missing server-side authorization on every object and action, especially POST, PUT, delete, and admin functions.
- Constrain SSRF-prone outbound requests Restrict which hosts, schemes, and destinations applications can call, and isolate access to internal services and metadata endpoints from user-controlled requests.
- Rework authentication into session and scope control Verify that logged-in users can only access their own records and approved functions, and that token claims are enforced by the server rather than trusted from the client.
Bottom line: Broken access control remains the most persistent web application risk because it combines authorization gaps, session weakness, and token abuse in one failure mode.
Glossary terms: Broken Access Control, Server-Side Request Forgery, Cryptographic Failure, Software Or Data Integrity Failure
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
21/08/2026 5:12 pm
Broken access control is now a governance problem, not just a code defect. The article’s examples show that authorization failures span APIs, tokens, object references, and session logic. That means identity proof is not the same as permission proof, which is where many application programmes still over-assume safety. Security teams should treat authorization scope as a first-class control objective.
A question worth separating out:
Q: How should organisations balance vulnerability scanning with secure-by-design reviews?
A: Scanning remains useful, but it cannot find every trust failure embedded in architecture, dependency handling, or release pipelines. Secure-by-design review is needed to catch flaws such as missing authorization boundaries, unsafe request handling, and unverified integrity controls before they become repeatable production risk.
👉 Read our full editorial: OWASP Top 10 2021 shows access control still drives web risk