{"id":"EUVD-2026-38559","enisaUuid":"f12b573a-ddb1-337d-80a2-6c791031d059","description":"Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.","datePublished":"Jun 23, 2026, 5:55:11 PM","dateUpdated":"Jun 26, 2026, 6:16:37 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-x5w9-xh9r-mvfc\n","aliases":"CVE-2026-45692\nGHSA-x5w9-xh9r-mvfc\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"6a28e91a-b391-3de1-b872-dac8c3cbf718","product":{"name":"caddy","vendor":{"name":"caddyserver"}},"product_version":"2.4.0, \u003c 2.11.3"}],"enisaIdVendor":[{"id":"ac163204-6ec8-3996-9d14-605b1546d309","vendor":{"name":"caddyserver"}}],"enisaIdVulnerability":[{"id":"1156d4c5-0c9a-3315-9dab-69c31bfcef40","vulnerability":{"id":"CVE-2026-45692","description":"Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.","datePublished":"Jun 23, 2026, 5:55:11 PM","dateUpdated":"Jun 26, 2026, 6:16:37 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-x5w9-xh9r-mvfc\n","enisa_id":"EUVD-2026-38559\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Oct 30, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"f67eedc8-a62a-3b46-9806-823d98dc2b47","product":{"name":"caddy","vendor":{"name":"caddyserver"}},"product_version":"2.4.0, \u003c 2.11.3"}],"vulnerabilityVendor":[{"id":"ea91e9e7-41dd-3f46-871b-cfa6e62ec8dd","vendor":{"name":"caddyserver"}}]}},{"id":"dc59e211-abac-3091-b663-0797b6248eaa","vulnerability":{"id":"GHSA-x5w9-xh9r-mvfc","description":"Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization","datePublished":"May 19, 2026, 3:51:31 PM","dateUpdated":"Jul 20, 2026, 1:43:05 PM","baseScore":0.0,"references":"https://github.com/caddyserver/caddy/security/advisories/GHSA-x5w9-xh9r-mvfc\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45692\nhttps://github.com/caddyserver/caddy\n","enisa_id":"EUVD-2026-38559\n","aliases":"CVE-2026-45692\nGHSA-x5w9-xh9r-mvfc\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}