CVE-2025-65097 Details
Description
RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No ownership verification is performed before deleting collections. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.
A vulnerability in RomM (ROM Manager) versions prior to 4.4.1 and 4.4.1-beta.2 allows authenticated users to delete collections belonging to other users. This is achieved by sending a DELETE request to the collection endpoint without any ownership verification. The vulnerability arises because the delete_collection() function removes collections by ID without checking if the user requesting the deletion actually owns the collection. While the ownership check is present in the delete_smart_collection() function, it is absent in the normal collections deletion process.
Users can update to RomM version 4.4.1 or 4.4.1-beta.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 3, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rommapp/romm/security/advisories/GHSA-v7c8-f6xc-rv9g | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| romm.app romm | < 4.4.1 4.4.1 beta1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 24, 2026 | Reanalysis | [email protected] |
| Feb 24, 2026 | Initial Analysis | [email protected] |
| Dec 3, 2025 | New CVE Received | [email protected] |