CVE-2026-53408: Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7

Synopsis

An improper authorization flaw in the custom URL scheme handler affects Zoom Workplace for Android (before 7.0.4) and iOS (before 7.0.3). The vulnerability is reachable over the network and requires only a low-privilege account, allowing an attacker to escalate their privileges within the application. Successful exploitation gives the attacker unauthorized read access to sensitive data and the ability to tamper with application data. A patched-image rebuild at version 7.0.4 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Zoom Workplace service over the network; there is no requirement for local or physical access.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker does not need admin or elevated credentials to trigger the flaw.

• Victim interactionNot required

  No user interaction is needed; the attacker can exploit the vulnerability without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions.

Blast Radius

• An attacker reads sensitive application data, which may include session tokens, private meeting metadata, or user account details.
• An attacker modifies application data or settings, enabling unauthorized actions within the Zoom Workplace session.
• The privilege escalation may allow the attacker to impersonate higher-privileged users or access functionality restricted to administrators.