CVE-2025-23023

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version

Description Discourse is an open source platform for community discussion. In affected versions, an attacker can carefully craft a request with the right request headers to poison the anonymous cache, which may have a response with missing preloaded data. This issue only affects anonymous visitors of the site.

Recommendations For versions prior to the latest version, users are advised to upgrade to the latest version of Discourse to resolve the issue. As a temporary workaround for users unable to upgrade, consider disabling anonymous cache by setting the DISCOURSE DISABLE ANON CACHE environment variable to a non-empty value.