The flaw is an improper authorization issue in Zoom Workplace’s handler for a custom URL scheme, allowing an unauthenticated user to trigger privileged network operations and thereby elevate privileges. This weakness is identified as CWE‑939. The CVSS score of 8.1 reflects high severity and indicates the potential for significant compromise of confidentiality or integrity if exploited.

Zoom Communications’ Zoom Workplace app on Android versions earlier than 7.0.4 and on iOS versions earlier than 7.0.3 is affected. All devices running those versions that host the app are at risk.

The flaw does not require authentication, so an attacker could trigger it by injecting a crafted custom URL scheme or employing an inter‑app attack to invoke Zoom Workplace, leading to privileged network access. Based on the description, it is inferred that this constitutes a network-based attack vector. The EPSS score is not available, but the CVSS score of 8.1 signals high risk. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit is reported, yet the ability for an unprivileged user to gain elevated access remains clear.