CVE-2025-65096
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, users can read private collections / smart collections belonging to other users by directly accessing their IDs via API. No ownership verification or checking if the collection is public/private before returning collection data. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.
Risk Assessment
The risk involves unauthorized access to private user data, which could compromise privacy and confidentiality of information stored in collections.
Recommendation
It is recommended to update RomM to version 4.4.1 or 4.4.1-beta.2 immediately to eliminate this vulnerability.
Other vulnerabilities in RomM
Original NVD description (English source)
RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, users can read private collections / smart collections belonging to other users by directly accessing their IDs via API. No ownership verification or checking if the collection is public/private before returning collection data. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS