CVE-2026-129429

Name of the Vulnerable Software and Affected Versions Frappe india-payroll versions prior to 16.0.4

Description Authenticated low-privileged users can access payroll data of other employees due to missing authorization in the tax regime selector.py file. By providing another employee identifier, an attacker can read base pay, earning, and deduction components. Additionally, they can modify the tax regime on draft Salary Structure Assignments, which impacts tax withholding. This issue affects the following functions: get employee details(), compute tax comparison(), and set tax regime().

Recommendations Update Frappe india-payroll to version 16.0.4 or later. As a temporary mitigation, restrict access to the get employee details(), compute tax comparison(), and set tax regime() functions.