Data Exposure in ROM Manager for Game Collections by RomM
CVE-2025-65096

5.3MEDIUM

Key Information:

Vendor

Rommapp

Status
Romm
Vendor
CVE Published:
3 December 2025

What is CVE-2025-65096?

The ROM Manager application allows users to manage and interact with their game collections easily. However, prior to version 4.4.1 and 4.4.1-beta.2, an API vulnerability existed that permitted users to access private collections and smart collections created by other users simply by inputting their IDs. This oversight meant there was no mechanism in place to verify ownership or check the privacy status of collections before the data was returned. The issue has been addressed in the mentioned updates, ensuring that users can only access their own collections securely.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

romm < 4.4.1-beta.2

References

https://github.com/rommapp/romm/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.