Which category is ranked first (A01) in the OWASP Top 10 2021?

"Broken Access Control" is first in 2021. It moved up from fifth place, and testers found it in 94% of the applications they tested. Access control means checking that a user is allowed to do an action or see a record. "Injection" is the tempting wrong answer: it was first in earlier editions, but in 2021 it dropped to A03. It now also includes XSS.