Odiflux
Cybersecurity

The most common vulnerabilities we found in business apps this year

Broken access control still tops the list, but AI features are creating a new class of risk.

Odiflux Security Team · 2 September 2026 · 6 min read

Across this year's penetration tests of web apps, APIs and ERP systems, a few patterns showed up again and again.

  • Broken object-level authorisation in APIs (IDOR)
  • Over-privileged service accounts and leaked API keys
  • Prompt injection in newly added AI assistants
  • Missing rate limits on authentication endpoints
  • Outdated third-party modules with known CVEs

What to do about it

Shift security left: threat-model new features, add SAST and dependency scanning to CI and schedule a manual test before every major release. Treat AI features as untrusted input processors, because that's what they are.

Keep reading

The 12-point Odoo implementation checklist we use on every projectERP
18 September 20268 min read

The 12-point Odoo implementation checklist we use on every project

Most ERP projects fail before a single line of configuration. Here's the checklist that keeps ours on time and on budget.

Migrating from .NET Framework to modern .NET without a big-bang rewrite.NET
21 August 202610 min read

Migrating from .NET Framework to modern .NET without a big-bang rewrite

The strangler-fig pattern, YARP and incremental migration: a practical playbook for legacy .NET estates.

How to find your first 10 automation wins in a weekAutomation
5 August 20267 min read

How to find your first 10 automation wins in a week

A simple scoring model to prioritise automation by effort, frequency and risk, with examples from finance, HR and sales.

Tell us about your challenge. A solutions architect will reply within one business day with ideas, not a sales pitch.

Book a free consultation
+974 6622 4655