PT-2025-44213 · Discourse · Discourse

Published 2025-10-28 · Updated 2025-11-06 · CVE-2025-61598

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.6.2 Discourse version 3.6.0.beta2

Description Discourse, an open source discussion platform, is affected by an issue where the default Cache-Control response header with the value no-store, no-cache was missing from error responses. This could lead to unintended caching of these responses by proxies, potentially resulting in cache poisoning attacks.

Recommendations Update to Discourse version 3.6.2 or later. Update to Discourse version 3.6.0.beta2 or later.

Exploit

Fix

Weakness Enumeration

CWE-524

Related Identifiers

BIT-DISCOURSE-2025-61598

CVE-2025-61598

GHSA-JP9X-WWV6-CV3J

Affected Products

Discourse

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61598.json · Exploit
• https://github.com/discourse/discourse/commit/fd567af7bf5a15c70772021acbdf5d38487a31bc · Patch
• https://github.com/discourse/discourse/commit/3ea1b663c82c067e5ca778db846bad1e082ba6cd · Patch
• https://osv.dev/vulnerability/BIT-discourse-2025-61598 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61598 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61598 · Security Note
• https://github.com/discourse/discourse/security/advisories/GHSA-jp9x-wwv6-cv3j · Note
• https://twitter.com/CVEnew/status/1983281368168538288 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1983381959616115017 · Twitter Post
• https://t.me/CVEtracker/36000 · Telegram Post