CVE-2026-45692

A flaw was found in Caddy, an extensible server platform. A remote administrator with restricted access to specific configuration objects could bypass these limitations. This occurs because the authorization system uses string prefix matching for access paths, while the configuration traversal...

CVE-2026-45692

creationtimestamp| type| source ---|---|--- 2026-06-23 20:25:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyabc4aok2g...

CVE-2026-45692

Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different...