An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
CWE-639