CVE-2026-45692 affects caddyserver caddy versions >=2.4.0 and <2.11.3. The vulnerability is due to a mismatch between the authorization layer and the /config traversal layer in how they interpret paths. The authorization layer uses string prefix matching, whereas the traversal layer parses array indices numerically using strconv.Atoi(). This discrepancy allows a path authorized for one config object to be accepted but then resolves to a different config object during traversal, potentially leading to unauthorized access. The issue is classified under CWE-187 (Partial Comparison) and CWE-863 (Incorrect Authorization). The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and low confidentiality and integrity impacts. The vulnerability is fixed in version 2.11.3.

The vulnerability can cause unauthorized access to configuration objects by exploiting the mismatch in path interpretation between the authorization and traversal layers. This may lead to partial confidentiality and integrity impacts on the server configuration. There is no indication of availability impact. No known exploits in the wild have been reported.

Upgrade caddyserver caddy to version 2.11.3 or later, where this vulnerability is fixed. Patch status is confirmed by the description stating the fix is in 2.11.3. No other mitigation or temporary workaround is indicated.