Broken Access Control occurs when an application fails to properly enforce restrictions on authenticated users, allowing them to access unauthorized data or functionality. It is ranked as the #1 security risk in the OWASP Top 10 for 2021, moving up from position #5 in 2017. 94% of applications tested had some form of broken access control. There were 318,000 occurrences in OWASP’s 2021 data set.