CVE-2026-45692 Details
Description
Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.
A remote admin authorization bypass vulnerability has been identified in Caddy versions 2.4.0 through 2.11.2. The issue arises because the authorization layer and the config traversal layer interpret array indices differently, leading to a mismatch in the objects being accessed. This allows a path authorized for one config object to be accepted while actually resolving to a different object during traversal. As a result, a remote admin client could read and modify unauthorized array elements, breaking least-privilege access policies.
Users should update to Caddy version 2.11.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/caddyserver/caddy/security/advisories/GHSA-x5w9-xh9r-mvfc | CISA-ADP | ExploitVendor Advisory |
| https://github.com/caddyserver/caddy/security/advisories/GHSA-x5w9-xh9r-mvfc | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-187 | Partial String Comparison | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| caddyserver caddy | >= 2.4.0, < 2.11.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | New CVE Received | [email protected] |