CVE-2026-129429

Sažetak

Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another employee identifier to read base pay and earning and deduction components, or change the tax regime on draft Salary Structure Assignments to affect tax withholding.

Reference

https://github.com/frappe/india-payroll
https://github.com/frappe/india-payroll/blob/9c1fc91b34de8a55df58aa5f2dbabff95dedb4d1/india_payroll/india_payroll/page/tax_regime_selector/tax_regime_selector.py#L207-L215
https://github.com/frappe/india-payroll/commit/78de736298a340ecb971826a5df10e7204773cef
https://github.com/frappe/india-payroll/commit/bdb988f172663db4054f9c3fc23833f10c3b60b0
https://github.com/frappe/india-payroll/releases/tag/v16.0.4
https://github.com/frappe/india-payroll/security/advisories/GHSA-758f-34xj-xvcc
https://www.vulncheck.com/advisories/frappe-india-payroll-before-16.0.4-missing-authorization-via-tax-regime-selector

CVSS

Base:	7.1
Impact:	4.2
Exploitability:	2.8

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	LOW

Impact

Povjerljivost	Cjelovitost	Dostupnost
HIGH	LOW	NONE

CVSS vektor

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Zadnje važnije ažuriranje

14-11-2026 - 13:17

Objavljeno

14-11-2026 - 13:17