Vulnerability details

CVE-2025-65097

rommapp romm

Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections

CVSS 4.0

7.1High

Official description

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No ownership verification is performed before deleting collections. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.

CVSS scores

Score	Version	Source	Vector
7.1High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N`

Affected products

Vendor	Product	Versions	Source
rommapp	romm	< 4.4.1-beta.2	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/rommapp/romm/security/advisories/GHSA-v7c8-f6xc-rv9g x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-12-03
Last updated: 2025-12-04
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.22%

Probability of exploitation in 30 days

12.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-284
Improper Access Control
CWE-639
Authorization Bypass Through User-Controlled Key