CVE-2026-129429
Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another employee identifier to read base pay and earning and deduction components, or change the tax regime on draft Salary Structure Assignments to affect tax withholding.
| CWE | CWE-862 |
| Vendor | frappe |
| Product | india-payroll |
| Published | Nov 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for frappe india-payroll
Be the first to know when new high vulnerabilities affecting frappe india-payroll are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
frappe / india-payroll
0 < 16.0.4
References
github.com: https://github.com/frappe/india-payroll/security/advisories/GHSA-758f-34xj-xvcc github.com: https://github.com/frappe/india-payroll/commit/78de736298a340ecb971826a5df10e7204773cef github.com: https://github.com/frappe/india-payroll/commit/bdb988f172663db4054f9c3fc23833f10c3b60b0 github.com: https://github.com/frappe/india-payroll/blob/9c1fc91b34de8a55df58aa5f2dbabff95dedb4d1/india_payroll/india_payroll/page/tax_regime_selector/tax_regime_selector.py#L207-L215 github.com: https://github.com/frappe/india-payroll/releases/tag/v16.0.4 github.com: https://github.com/frappe/india-payroll vulncheck.com: https://www.vulncheck.com/advisories/frappe-india-payroll-before-16.0.4-missing-authorization-via-tax-regime-selector
Credits
Darshan U asmitahase