Cache Poisoning Vulnerability in Discourse Discussion Platform

CVE-2025-61598

What is CVE-2025-61598?

Discourse, a popular open-source discussion platform, had a vulnerability in versions prior to 3.6.2 and 3.6.0.beta2 due to the absence of a default Cache-Control response header. Specifically, the no-store, no-cache directive was missing from error responses, which could lead to unintended caching by intermediaries such as proxies. This behavior poses a risk of cache poisoning attacks, allowing an attacker to inject harmful content into cached responses, potentially compromising user data. The issue has been addressed in the updates 3.6.2 and 3.6.0.beta2, which restore proper cache control measures.

References