PT-2025-47564 · Romm · Romm

Published 2025-11-20 · Updated 2025-12-03 · CVE-2025-65096

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RomM versions prior to 4.4.1 RomM version 4.4.1-beta.2

Description RomM (ROM Manager) enables users to manage their game collections through a user interface. A flaw exists where users can access private or smart collections belonging to other users by directly using their IDs through an API. The system does not verify ownership or check if a collection is public before returning collection data. The API endpoint allowing this access is not specified. The vulnerable parameter is the collection ID.

Recommendations Update RomM to version 4.4.1 or 4.4.1-beta.2.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2025-65096

GHSA-5GHC-8WR3-788C

Affected Products

Romm

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65096.json · Exploit
• https://github.com/rommapp/romm/security/advisories/GHSA-5ghc-8wr3-788c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65096 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65096 · Vendor Advisory
• https://twitter.com/CVEnew/status/1996306041437397434 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1996354581735846271 · Twitter Post
• https://biteyourconsole.net/2025/11/20/rilasciato-romm-v4-4-1-patch-per-vulnerabilita-e-miglioramenti-nella-gestione-delle-rom/?fsp_sid=48340 · Reddit Post
• https://t.me/CVEtracker/38791 · Telegram Post