VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 3, 2025· Updated Dec 3, 2025

Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections

CVE-2025-65097

Description

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No ownership verification is performed before deleting collections. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.

Affected products

2
  • Rommapp/Rommllm-fuzzy
    Range: <4.4.1
  • rommapp/rommv5
    Range: < 4.4.1-beta.2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.