Missing Authorization in Frappe India-Payroll Allows Access to Employee Payroll Data

CVE-2026-129429

What is CVE-2026-129429?

Frappe india-payroll versions prior to 16.0.4 exhibit a vulnerability in the tax_regime_selector.py file, where methods such as get_employee_details, compute_tax_comparison, and set_tax_regime lack proper authorization checks. This flaw enables authenticated, low-privileged users to access sensitive payroll information of other employees by providing alternative employee identifiers. Attackers could potentially manipulate draft Salary Structure Assignments to unjustly alter tax regimes, impacting withholding amounts. It is crucial for users to upgrade to version 16.0.4 or later to mitigate this security risk.

References