From 2df340cddfafd88f754df476dcc1a81d0b8e479e Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Thu, 6 Aug 2026 02:27:49 +0000
Subject: [PATCH] fix: V-001 security vulnerability

Automated security fix generated by OrbisAI Security
---
 server/routes/setup.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/server/routes/setup.js b/server/routes/setup.js
index 552600c63..43f0bdaa6 100644
--- a/server/routes/setup.js
+++ b/server/routes/setup.js
@@ -117,8 +117,15 @@ const buildRouter = ({ basePath, dbPool, allowAfterComplete = false } = {}) => {
   router.use(async (ctx, next) => {
     const rel = relativePath(ctx)
     if (!rel.startsWith('/api/setup')) return next()
-    if (!process.env.SETUP_TOKEN) return next()
     if (rel === '/api/setup/token' || rel === '/api/setup/preflight' || rel === '/api/setup/state') return next()
+    if (!process.env.SETUP_TOKEN) {
+      if (!isLoopback(ctx.request.ip)) {
+        ctx.status = 403
+        ctx.body = { error: 'Setup endpoints are only accessible from localhost when SETUP_TOKEN is not configured.' }
+        return
+      }
+      return next()
+    }
     const provided = (ctx.request.body && ctx.request.body.token) || ctx.get('X-Setup-Token')
     if (provided && timingSafeStringEqual(provided, process.env.SETUP_TOKEN)) return next()
     ctx.status = 401