CVE-2025-68049 bunny.net CVE debrief

Who should care

Defenders responsible for bunny.net deployments, particularly those using versions up to 2.3.6, should assess exposure and consider necessary actions.

Why it matters

Defenders should prioritize verifying exposure of bunny.net versions up to 2.3.6 and assessing the need for updates or compensating controls due to a Subscriber Broken Access Control vulnerability.

• Verification of access controls and subscriber configurations is necessary to prevent potential unauthorized access.
• Defenders should assess the need for updates or compensating controls to mitigate the vulnerability.
• Exposure to this vulnerability may require additional monitoring and incident response planning.

Technical summary

The CVE record indicates a Subscriber Broken Access Control vulnerability in bunny.net versions up to 2.3.6. The CVSS score is 6.3, with a severity rating of MEDIUM.

Defensive priority

Defenders should prioritize verifying exposure of bunny.net versions up to 2.3.6 and assessing the need for updates or compensating controls.

Recommended defensive actions

• Verify bunny.net version and assess exposure
• Review access controls and subscriber configurations
• Consider updating to a version beyond 2.3.6 if available

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is required to determine the full scope of affected systems and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.