Data Exposure in ROM Manager for Game Collections by RomM

CVE-2025-65096

What is CVE-2025-65096?

The ROM Manager application allows users to manage and interact with their game collections easily. However, prior to version 4.4.1 and 4.4.1-beta.2, an API vulnerability existed that permitted users to access private collections and smart collections created by other users simply by inputting their IDs. This oversight meant there was no mechanism in place to verify ownership or check the privacy status of collections before the data was returned. The issue has been addressed in the mentioned updates, ensuring that users can only access their own collections securely.

References