Cisco Talos is disclosing a user enumeration vulnerability in Zoom Communications that could allow a malicious user to obtain a complete list of Zoom users inside a specific organization. The vulnerability arises from the lack of validation to ensure the requesting user belongs to a queried domain. The exploitation process requires the user to properly authenticate to Zoom with a valid user account, the user then sends an XMPP message with the content below to receive a list of users associated with the domain arbitrary_domain.com.”]
Source: https://blog.talosintelligence.com/2020/04/zoom-user-enumeration.html