← CVE Intelligence

CVE-2026-45692

Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization PUBLISHED

Description (CNA)

Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.

Affected (CNA)

Vendor / productVersions
caddyserver / caddyaffected >= 2.4.0, < 2.11.3

CWE

CWE-187, CWE-863

References

ADP enrichment

CISA-ADP

No English description supplied.