Cyber Resilience

CVE-2025-61598

Discourse ≤ 3.5.2

Published
28 October 2025
Modified
03 December 2025
Patch / advisory
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0028 20th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-61598 is a medium-severity Use of Cache Containing Sensitive Information (CWE-524) vulnerability in Discourse Discourse. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning…

more

attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Missing Cache-Control header on error responses in Discourse enables remote, unauthenticated cache poisoning attacks on public-facing web applications.

CVEs Like This One

CVE-2026-33411Same product: Discourse Discourse
CVE-2026-46413Same product: Discourse Discourse
CVE-2026-33426Same product: Discourse Discourse
CVE-2025-68662Same product: Discourse Discourse
CVE-2026-33424Same product: Discourse Discourse
CVE-2026-29072Same product: Discourse Discourse
CVE-2026-26077Same product: Discourse Discourse
CVE-2026-27154Same product: Discourse Discourse
CVE-2026-27166Same product: Discourse Discourse
CVE-2026-27149Same product: Discourse Discourse

Affected Assets

discourse
discourse
3.6.0 · ≤ 3.5.2 · ≤ 3.6.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • CM-6 Configuration Settings
  • SC-8 Transmission Confidentiality and Integrity
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V14.3.2

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires configuring the web server/application to emit the correct Cache-Control: no-store, no-cache header on every response, including error pages, eliminating the root cause of the missing header.

detect

Enables integrity verification of HTTP responses so that cached poisoned error pages can be detected before they are served to users.

prevent

Requires cryptographic and header-based protections on transmitted web content, which encompasses ensuring cache-control directives prevent intermediary caching of sensitive error responses.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 mostly match
prevents

Protecting confidentiality of data-at-rest covers caches that persist sensitive information.

PR.AA-05 partial match
prevents

Enforcing least-privilege access permissions directly limits who can read cached sensitive data.

PR.DS-10 partial match
prevents

Protecting data-in-use can mitigate exposure when caches hold transient sensitive values.

PR.IR-01 partial match
prevents

Logical access controls on environments reduce the chance an outsider can reach the cache.

PR.PS-01 partial match
prevents

Hardened configuration baselines can disable or secure caching of sensitive data.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Data leakage prevention can block unauthorized access to cached sensitive information.

prevents

Information access restriction directly limits who can read cached sensitive data.

mitigates

Information deletion ensures sensitive data is removed from caches when no longer needed.

mitigates

Cryptography can protect cached data at rest, but does not address access control scope.

prevents

Secure coding practices prevent caching of sensitive data outside intended boundaries.

none

Environment separation reduces risk of cache exposure across development/test/production.

References