Vulnerability · Published Oct 28, 2025 · Assigned by GitHub_M

CVE-2025-61598Discourse is missing Cache-Control response header on error responses

Medium 6.3

In plain English

A medium-severity security flaw in discourse from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.3%top 77.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2.

Affected products (as reported)

Vendor	Product	Versions
discourse	discourse	< 3.6.2>= 3.6.0.beta1, < 3.6.0.beta2

Weakness: CWE-524 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/discourse/discourse/security/advisories/GHSA-jp9x-wwv6-cv3j x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/3ea1b663c82c067e5ca778db846bad1e082ba6cd x_refsource_MISC
https://github.com/discourse/discourse/commit/fd567af7bf5a15c70772021acbdf5d38487a31bc x_refsource_MISC