CVE-2025-61598

Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/discourse/discourse/commit/3ea1b663c82c067e5ca778db846bad1e082ba6cd	Patch
https://github.com/discourse/discourse/commit/fd567af7bf5a15c70772021acbdf5d38487a31bc	Patch
https://github.com/discourse/discourse/security/advisories/GHSA-jp9x-wwv6-cv3j	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:discourse:discourse:::::stable:::*
	cpe:2.3:a:discourse:discourse:::::beta:::*
	cpe:2.3:a:discourse:discourse:3.6.0:beta1:::beta:::*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Discourse es una plataforma de discusión de código abierto. La versión anterior a 3.6.2 y 3.6.0.beta2, el encabezado de respuesta Cache-Control predeterminado con el valor no-store, no-cache faltaba en las respuestas de error. Esto pudo haber causado el almacenamiento en caché no intencionado de esas respuestas por parte de proxies, lo que podría llevar a ataques de envenenamiento de caché. Esta vulnerabilidad está corregida en 3.6.2 y 3.6.0.beta2.

Information

Published : 2025-10-28 21:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-61598

Mitre link : CVE-2025-61598

CVE.ORG link : CVE-2025-61598

JSON object : View

Products Affected

discourse

discourse

CWE

CWE-524

Use of Cache Containing Sensitive Information

{"id": "CVE-2025-61598", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61598", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-29T13:41:37.647894Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "discourse", "product": "discourse", "versions": [{"status": "affected", "version": "< 3.6.2"}, {"status": "affected", "version": ">= 3.6.0.beta1, < 3.6.0.beta2"}]}]}], "published": "2025-10-28T21:15:40.110", "references": [{"url": "https://github.com/discourse/discourse/commit/3ea1b663c82c067e5ca778db846bad1e082ba6cd", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/discourse/discourse/commit/fd567af7bf5a15c70772021acbdf5d38487a31bc", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/discourse/discourse/security/advisories/GHSA-jp9x-wwv6-cv3j", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-524"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2."}, {"lang": "es", "value": "Discourse es una plataforma de discusi\u00f3n de c\u00f3digo abierto. La versi\u00f3n anterior a 3.6.2 y 3.6.0.beta2, el encabezado de respuesta Cache-Control predeterminado con el valor no-store, no-cache faltaba en las respuestas de error. Esto pudo haber causado el almacenamiento en cach\u00e9 no intencionado de esas respuestas por parte de proxies, lo que podr\u00eda llevar a ataques de envenenamiento de cach\u00e9. Esta vulnerabilidad est\u00e1 corregida en 3.6.2 y 3.6.0.beta2."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "DEEB60B8-86DD-4EFF-962F-C44D9FBF6876", "versionEndExcluding": "3.5.2"}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "4C433F55-3787-4B9E-8028-ED55F6B9056B", "versionEndExcluding": "3.6.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.6.0:beta1:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E39E0-7F3D-4DBA-A8AD-7440BCEBB984"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}