CVE-2025-65097 - Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections

Back Back to CVE browser

HIGH

Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections

Published Dec 3, 2025

7.1

HIGH

CVSS 4.0

EPSS 0.21%

Description

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No ownership verification is performed before deleting collections. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.

Affected products

Vendor Rommapp Product Romm Default
unknown
Affected
- < 4.4.1-beta.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Rommapp	Romm	unknown	Affected < 4.4.1-beta.2

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-639

Authorization Bypass

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201129
Advisory
https://github.com/rommapp/romm/security/advisories/GHSA-v7c8-f6xc-rv9g
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201129		Advisory
https://github.com/rommapp/romm/security/advisories/GHSA-v7c8-f6xc-rv9g		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Dec 3, 2025

Updated Dec 3, 2025

Reserved Nov 17, 2025

Link CVE-2025-65097

CISA Vulnrichment

Updated Dec 3, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-65097

Red Hat

No data

ENISA EUVD

Assigner GitHub_M

Published Dec 3, 2025

Updated Dec 3, 2025

Link EUVD-2025-201129

GitHub

No data