What is 'OWASP A01:2021 Broken Access Control' and why did it move to the top position from A05 in 2017?

• A.A01 Broken Access Control moved up because access control was added as a new vulnerability category in 2021
• B.Broken Access Control moved to #1 in OWASP 2021 because it was the most commonly found vulnerability in security assessments (found in 94% of applications tested). It encompasses: IDOR (insecure direct object references), privilege escalation, CORS misconfigurations, missing function-level access control, JWT manipulation, insecure direct object access in APIs. Its prevalence in real applications made it the highest-frequency finding
• C.A01 moved up because it is the most severe vulnerability type in terms of impact
• D.A01 replaced SQL injection at the top; SQL injection is no longer in the OWASP Top 10