A flaw in the custom URL scheme handler of Zoom Workplace for Android allows an unauthenticated user to bypass authorization controls and gain elevated privileges, enabling the attacker to access network resources and potentially perform further malicious actions. The vulnerability arises from improper verification of requests handled by the URL scheme, permitting access to privileged functionality without authentication. As a result, malicious actors could execute network‑level operations that would otherwise be restricted to authorized users.

Zoom Communications’ Zoom Workplace for Android is affected. The problem exists in all releases before version 7.2.1; devices running 7.2.0 or earlier are vulnerable. Updated builds from 7.2.1 onward contain the fix.

The CVSS score of 8.1 classifies this as a high‑risk vulnerability. No EPSS data is available, and it is not listed in CISA’s KEV catalog. The weakness is likely exploitable via a network‑based attack vector because the description specifies network access, and the attacker does not need credentials. Given the severity and lack of mitigation in earlier versions, organizations should treat this as a critical risk until patched.