CVE-2026-53408

{
  "id": "CVE-2026-53408",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T19:16:30.093",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access."
    },
    {
      "lang": "es",
      "value": "Autorización indebida en el gestor para el esquema de URL personalizado en Zoom Workplace anterior a la versión 7.0.4 para Android y anterior a la 7.0.3 para iOS puede permitir a un usuario no autenticado realizar una escalada de privilegios a través de acceso a la red."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Zoom Communications",
          "product": "Zoom Workplace",
          "defaultStatus": "unaffected",
          "platforms": [
            "Android",
            "iOS"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "7.0.4",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-16T03:55:59.343130Z",
          "id": "CVE-2026-53408",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-939"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:iphone_os:*:*",
              "versionEndExcluding": "7.0.3",
              "matchCriteriaId": "0DAE65F5-DF4E-4C7B-B91A-04465CFCA20B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:android:*:*",
              "versionEndExcluding": "7.0.4",
              "matchCriteriaId": "54D23CAF-7192-4D22-BA1A-5F625ADFF159"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zoom:workplace:*:*:*:*:*:iphone_os:*:*",
              "versionEndExcluding": "7.0.3",
              "matchCriteriaId": "849B9B0E-375F-49EC-86DD-3C8E6C505C71"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zoom:workplace:*:*:*:*:*:android:*:*",
              "versionEndExcluding": "7.0.4",
              "matchCriteriaId": "7F76A339-7CE1-4BAD-A4CB-DCC5217BD77B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-26010",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}