Vulnerability · Published Dec 3, 2025 · Assigned by GitHub_M

CVE-2025-65097Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections

High 7.1

In plain English

A high-severity improper access control in romm from rommapp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 87.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No ownership verification is performed before deleting collections. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.

Affected products (as reported)

Vendor	Product	Versions
rommapp	romm	< 4.4.1-beta.2

Weakness: CWE-284, CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

References

https://github.com/rommapp/romm/security/advisories/GHSA-v7c8-f6xc-rv9g x_refsource_CONFIRM