CVE-2026-92700

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...

CVE-2026-92700 Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...

CVE-2026-92700: Improper Handling of Case Sensitivity

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...

CVE-2026-84716: Incorrect Privilege Assignment

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

EUVD-2026-84011

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for...

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for GitHub Advisory Details form fields — paste-ready Affected products | Field | Value | |-------|-------| | Ecosystem |...

GHSA-328G-JX67-V94G Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for GitHub Advisory Details form fields — paste-ready Affected products | Field | Value | |-------|-------| | Ecosystem |...

CVE-2026-77560 Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cas...

CVE-2026-77560

The Tinyauth authentication and authorization server (versions

CVE-2026-77560 Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cas...

CVE-2026-52740

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...

CVE-2026-52740 GoCD is vulnerable to pipeline template view API authorization bypass

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...

EUVD-2026-83951

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...

CVE-2026-52740 GoCD is vulnerable to pipeline template view API authorization bypass

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...

CVE-2026-52740

GoCD (continuous delivery server) versions 18.7.0 through 26.1.0 are affected by an authorization bypass in the Get Template Config API . The root cause is a case-sensitive comparison of HTTP method names when selecting authorization filters. A lower-privileged authenticated user can send a reque...

CVE-2026-52740 GoCD is vulnerable to pipeline template view API authorization bypass

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...

Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) images by vulnerabilities in github.com/caddyserver/caddy/v2 package

Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark images by vulnerabilities in github.com/caddyserver/caddy/v2 package. IBM Optim 1.2.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-27587 DESCRIPTION:...

tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm

In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...

CVE-2026-77560: Improper Handling of Case Sensitivity

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cas...

CVE-2026-52740: Incorrect Authorization

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...