CVE-2025-61598

Oct. 28, 2025, 9:15 p.m.

6.3
Medium

Description

Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2.

Product(s) Impacted

Vendor Product Versions
Discourse
  • Discourse
  • <3.6.2, <3.6.0.beta2

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-524
Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a discourse discourse <3.6.2 / / / / / / /
a discourse discourse <3.6.0.beta2 / / / / / / /

References

https://github.com/discourse/discourse/commit/3ea1b663c82c067e5ca778db846bad1e082ba6cd
https://github.com/discourse/discourse/commit/fd567af7bf5a15c70772021acbdf5d38487a31bc
https://github.com/discourse/discourse/security/advisories/GHSA-jp9x-wwv6-cv3j

Tags

security-advisories@github.com
CWE-524
2025-10-28
CVE-2025-61598

CVSS Score

6.3 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Attack Requirements: PRESENT
  • Privileges Required: NONE
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: LOW
  • Integrity Impact: NONE
  • Availability Impact: NONE
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: Oct. 28, 2025, 9:15 p.m.
Last Modified: Oct. 28, 2025, 9:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.