CVE-2025-65096 — RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections

CVE-2025-65096

RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections PUBLISHED

Description (CNA)

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, users can read private collections / smart collections belonging to other users by directly accessing their IDs via API. No ownership verification or checking if the collection is public/private before returning collection data. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.

Affected (CNA)

Vendor / product	Versions
rommapp / romm	affected < 4.4.1-beta.2

CWE

CWE-284, CWE-639

References

https://github.com/rommapp/romm/security/advisories/GHSA-5ghc-8wr3-788c

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.