From Caddy version 2.4.0 through 2.11.3, the authorization system and the /config traversal subsystem interpret request paths differently. The authorization layer uses string prefix matching to determine an allowed config object, while the /config traversal layer parses array indices numerically using strconv.Atoi(). Consequently, a path that is authorized for one configuration object can resolve to a different object during traversal, allowing an attacker to read or modify configuration data that should not be accessible. This breach is an input validation flaw (CWE-187), an authorization bypass (CWE-863), and can also be interpreted as a path traversal issue (CWE-551). The vulnerability is fixed in Caddy 2.11.3.

The affected product is Caddy from the caddyserver organization. All Caddy releases from version 2.4.0 up to 2.11.2 are impacted. Operating systems or deployment methods are not further specified in the advisory.

The CVSS score of 5.4 and an EPSS score of less than 1% indicate a low probability of widespread exploitation. The vulnerability is not listed in KEV. Based on the description, it is inferred that a remote attacker who can send HTTP requests to the /config endpoint, especially from an untrusted or compromised network, can exploit the mismatch between the authorization layer and the traversal layer. By crafting a request path that is authorized for one configuration object but resolves to a different object during traversal, the attacker can read or modify configuration data that should not be accessible.