CVE-2025-1226 is a medium severity improper authorization flaw in ywoa, also tracked as r1bbit yimioa, in setup.jsp. It affects versions up to 2024.07.03 and scores 5.3 on NVD. The record says upgrading to version 2024.07.04 addresses it, so upgrade and block the setup path.
What's affected
The NVD record says ywoa versions up to 2024.07.03 are affected. The file is /oa/setup/setup.jsp. The vendor product in the record's product list is r1bbit yimioa.
The record states that upgrading to version 2024.07.04 is able to address the issue and recommends upgrading the affected component. That is the only fixed version the record names. The CVSS vector is network based with no privileges required, and it rates the impact as low, with only a limited confidentiality effect.
The record says an exploit has been disclosed to the public. The issue is improper authorization, meaning the setup page does not check who is allowed to use it.
How to check if you're exposed
- Find your ywoa or YimiOA installs. Search for the setup path on the server:
find / -path "*oa/setup/setup.jsp" 2>/dev/null. - Read the version from the admin interface or the build you deployed. Version 2024.07.03 or older is in scope.
- From a machine outside your admin network, check whether the /oa/setup/ path answers at all. A setup page that is reachable on a live system is a sign that it should have been removed or restricted.
- Review your web logs for requests to the setup path from addresses you do not recognise.
What to do now
- Upgrade to version 2024.07.04 or later, and test the upgrade on a copy first.
- Whether or not you upgrade today, block the /oa/setup/ path at your web server or reverse proxy once the installation is complete. A setup page has no business being reachable in production.
- Restrict the application to the networks that need it, such as your office or VPN.
- Review configuration and admin accounts for changes you did not make. Improper authorization on a setup page raises the question of whether someone changed settings.
- Add the application to your software inventory so that you hear about the next fix.
Why it matters
The record lists CWE-285, improper authorization, and CWE-266, incorrect privilege assignment. In practice both say the same thing: the code lets a request through that should have been refused. Setup and install pages are a classic place for it, because developers write them for the first run and forget them afterwards.
The score is medium because the vector only rates a small confidentiality impact. Do not stop at the number. An office automation system holds documents, accounts and workflow data, and a setup page that anyone can reach may offer more than the vector assumes. Read the vendor's changelog for 2024.07.04 to see what else changed.
The record does not mark this CVE as exploited and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Which version fixes CVE-2025-1226?
The NVD record says upgrading to version 2024.07.04 addresses it. Check the project's changelog to confirm what else changed.
Should the setup page be reachable in production?
No. Remove it or block it once installation is done. That removes a whole class of authorization problems.
Sources
Last reviewed: 19 October 2026.
