7.1Hoch
CVE-2026-129429Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector
Beschreibung
Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another employee identifier to read base pay and earning and deduction components, or change the tax regime on draft Salary Structure Assignments to affect tax withholding.
Schwachstellentyp (CWE):
CWE-862
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| frappe | india-payroll | < 16.0.4, fixed 16.0.4 |
Referenzen und Patches
- GitHub Security Advisory (GHSA-758f-34xj-xvcc) vendor-advisory
- Patch Commit (develop) patch
- Patch Commit (v16.0.4) patch
- set_tax_regime without permission check at v16.0.3 technical-description
- india-payroll v16.0.4 Release Notes release-notes
- https://github.com/frappe/india-payroll product
- VulnCheck Advisory: Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector third-party-advisory