Broken Access Control rose from #5 in 2017 to #1 in 2021, and it’s still #1 in the 2025 edition. Now, compare to injection: it was #1 in 2017 and fell to #3 in 2021. In 2025 it’s #5. Why one fell and the other one is still at the top? To be clear, these are my opinions, not OWASP’s. Injection got generic defense(s). Parameterized queries, ORMs and framework defaults made its most common forms much harder to commit by accident. Access control can’t be solved that way...