An improper authorization check in the handler for Zoom Workplace’s custom URL scheme enables an unauthenticated user to elevate privileges. The flaw is present in Android builds prior to version 7.0.4 and iOS builds prior to 7.0.3, allowing the attacker to gain elevated permissions without needing legitimate account credentials. This could lead to unauthorized data exposure, control over the application, or execution of unintended actions within the Zoom platform.

The vulnerability affects Zoom Communications’ Zoom Workplace product on both Android and iOS platforms; specifically, Android releases before version 7.0.4 and iOS releases before version 7.0.3 are impacted. An update to the specified minimum versions removes the flaw and is the recommended mitigation.

The CVSS score of 8.1 indicates a high severity. With no EPSS data available, the likelihood of exploitation cannot be quantified, but the lack of a KEV listing suggests no confirmed field‑used exploitation yet. The flaw’s exploitation requires network access to the device hosting Zoom Workplace, with no authentication needed, making it potentially reachable from external networks or internal untrusted networks. Once exploited, the attacker gains elevated privileges within the app context.