A protection mechanism failure (CWE‑693) in Zoom Workplace for iOS before version 7.0.0 enables an authenticated user to disclose sensitive information when the device is physically accessed. The flaw involves a lapse in countermeasures that normally guard against data exposure during physical access, allowing an attacker who has already authenticated to Zoom to retrieve data that should otherwise remain protected.

Zoom Communications’ Zoom Workplace application for iOS versions earlier than 7.0.0 is affected. Users of these older releases running the app on iOS devices are at risk if the device is physically accessed by an attacker.

The CVSS score of 1.8 indicates a low severity vulnerability. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires physical access to a device where the user is already authenticated to the Zoom Workplace app. Because the attack vector is limited to physical possession and the vulnerability does not affect unauthenticated users or remote attackers, the overall risk to systems and data is minimal under normal circumstances.