Authorization Layer Mismatch in Caddy Server Platform

CVE-2026-45692

What is CVE-2026-45692?

In Caddy Server versions 2.4.0 to 2.11.3, a significant issue exists where the authorization layer fails to align with the configuration traversal layer. This discrepancy allows unauthorized access to certain configurations by permitting paths that should not be accessible according to the authorization constraints. Specifically, the problem arises from the authorization layer's reliance on string prefix matching, while the traversal layer interprets paths using numerical parsing (strconv.Atoi). As a result, a path authenticated for one configuration object may inadvertently resolve to another, posing potential security risks. This issue was remedied in version 2.11.3.

References