Cache Poisoning Vulnerability in Discourse by Discourse

CVE-2025-23023

What is CVE-2025-23023?

In Discourse, a widely used open-source community discussion platform, a cache poisoning vulnerability allows an attacker to craft malicious requests aimed at manipulating the anonymous cache. This manipulation can lead to responses that lack essential preloaded data, affecting the experience of anonymous visitors. To mitigate this issue, users are strongly encouraged to update to the latest version of Discourse. For those unable to perform the upgrade, it is advisable to disable the anonymous cache by configuring the DISCOURSE_DISABLE_ANON_CACHE environment variable appropriately.

References