From Caddy version 2.4.0 through 2.11.3, the authorization system and the /config traversal subsystem interpret request paths differently. The authorization layer uses string prefix matching to determine an allowed config object, while the /config traversal layer parses array indices numerically using strconv.Atoi(). Consequently, a path that is authorized for one configuration object can resolve to a different object during traversal, allowing an attacker to read or modify configuration data that should not be accessible. This breach is an input validation flaw (CWE‑187) and an authorization bypass (CWE‑863). The vulnerability is fixed in Caddy 2.11.3.

The affected product is Caddy from the caddyserver organization. All Caddy releases from version 2.4.0 up to but excluding 2.11.3 are impacted. Operating systems or deployment methods are not further specified in the advisory.

The CVSS score of 5.4 indicates a moderate severity. No EPSS value is available, so the likelihood of exploitation cannot be quantified from the advisory. The issue is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. The attack vector is inferred to be remote, requiring the ability to send HTTP requests to the /config endpoint, which is typically accessible only from trusted networks.