This vulnerability (CVE-2026-53407) concerns improper authorization in the custom URL scheme handler of Zoom Workplace before version 7.0.4 on Android and before 7.0.3 on iOS. An unauthenticated attacker with network access could exploit this flaw to escalate privileges within the application. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity. The vulnerability is tracked by the Bundesamt für Sicherheit in der Informationstechnik under advisory WID-SEC-W-2026-1839. No patch links or remediation details are provided, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an unauthenticated attacker to escalate privileges in the Zoom Workplace app, potentially leading to unauthorized access to sensitive information or elevated capabilities within the app. The confidentiality and integrity of the affected system could be compromised. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Zoom Communications' official channels for updates addressing this vulnerability. Until a fix is available, restricting network access to the application and limiting exposure may reduce risk.