CVE-2026-45692: Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

A remote admin client certificate restricted to the following path:

/config/apps/http/servers/srv/routes/0

can still read and modify a different array element by requesting:

/config/apps/http/servers/srv/routes/01

This happens because:

• the authorization layer uses string prefix matching
• the /config traversal layer parses array indices numerically using strconv.Atoi()

So:

• authorization sees /…/01 as matching /…/0
• traversal resolves 01 to numeric index 1
• the request therefore targets routes[1], not routes[0]

This is not just a prefix-match quirk. It is an authorization-to-object mismatch.