CVE-2026-30904

MediumCVSS 4.3/10Last modified Oct 26, 2026

Description

Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical access.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
Zoom Communications	Zoom Workplace	< 7.0.0

References

https://www.zoom.com/en/trust/security-bulletin/zsb-26006Vendor Advisory

Timeline

Published: May 13, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-309057.8External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authen CVE-2026-309067.8Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalati CVE-2026-309099.8Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows. bin2hex, encrypt, aes256gcm_encrypt_afternm and seal f CVE-2026-30917.3An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary CVE-2026-309107.5Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined signature creation CVE-2026-309118.1Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints th CVE-2026-309127.5In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lea CVE-2026-309134.6Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string t CVE-2026-309148.1SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between t CVE-2026-309154.3SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handli CVE-2026-309178.8Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to 2.1.1, a stored XSS can be inserted into any Buc CVE-2026-309186.1facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , a reflected XSS occurs when an application re