Which of the following is a category in the OWASP Top 10?

• A. Data Minimization.
• B. Passwordless.
• C. Broken Access Control.
• D. Rate Limiting.

Answer: (C)

Understanding why authorization controls are crucial helps explain why this is a Top 10 category. The OWASP Top 10 highlights the most critical web application security risks, and Broken Access Control describes situations where the app fails to enforce who is allowed to do what. When authorization checks aren’t applied consistently on every request, users can access data or perform actions beyond their privileges, leading to leaks, impersonation, or unauthorized operations. For example, an endpoint might return another user’s private information or allow a non-admin to perform admin-level actions because the server didn’t properly verify permissions each time a request is made. That kind of vulnerability is exactly what Broken Access Control captures.

The other options don’t represent Top 10 vulnerability categories. Data Minimization is a privacy principle, not a security vulnerability type. Passwordless refers to a way of authenticating users, not a vulnerability category in the Top 10. Rate Limiting is a defensive technique to prevent abuse or DoS, not a listed vulnerability.