OWASP Top 10 — 2021

OWASP. (2021). OWASP Top 10 — 2021: A01 Broken Access Control.

Type

Standard

Intellectual base

Reference work

Year

2021

Pages cited

10-2021

Link

https://owasp.org/Top10/

Cited from

computer_science

Cited by

2 citations across 2 artifacts.

Each citation links to the sentence it supports in the citing article.

Primes

• Access Control
  • Loose policies speed work but expand blast radius

    This sourceRanks Broken Access Control #1 (94% of tested apps affected); enumerates least-privilege/deny-by-default violations, IDOR, missing function-level checks, and horizontal/vertical privilege escalation.

    Supported in partVerified against the work's full text

    OWASP A01 names IDOR, API endpoints lacking access checks, privilege elevation and the Confused Deputy CWE, but not TOCTOU or the horizontal/vertical terms.

    “Permitting viewing or editing someone else's account, by providing its unique identifier (insecure direct object references)”

    Read by an automated reader; not a human review. How support was checked

• Indirection
  • The layer itself can become a target or a bottleneck for attacks

Verification

Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.

Does it back the claim? Read against the text for 1 of 2 citations: 1 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.

Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.

See how references were verified.

Links previously used in the corpus

Before the registry existed this work was also linked 1 other way.

• https://owasp.org/Top10/2021/A01_2021-Broken_Access_Control/ ×1

Registry ID ref:974af4cdd662 · see in the full table