CVE-2026-45692

Name of the Vulnerable Software and Affected Versions Caddy versions 2.4.0 through 2.11.2

Description An authorization-to-object mismatch exists in the remote admin functionality. The authorization layer uses string prefix matching, while the /config traversal layer parses array indices numerically using the strconv.Atoi() function. This discrepancy allows a remote admin client restricted to a specific path, such as /config/apps/http/servers/srv/routes/0, to access and modify a different array element by using a leading-zero index, such as /config/apps/http/servers/srv/routes/01. In this scenario, the authorization layer accepts the request because it matches the prefix, but the traversal layer resolves the index 01 to numeric index 1, granting unauthorized access to a different configuration object.

Recommendations Update to version 2.11.3. As a temporary workaround, restrict the use of the /config API paths containing numeric array indices for remote admin clients until the update is applied.