7.1Yüksek
CVE-2026-129429Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector
Açıklama
Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another employee identifier to read base pay and earning and deduction components, or change the tax regime on draft Salary Structure Assignments to affect tax withholding.
Zayıflık türü (CWE):
CWE-862
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| frappe | india-payroll | < 16.0.4, fixed 16.0.4 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-758f-34xj-xvcc) vendor-advisory
- Patch Commit (develop) patch
- Patch Commit (v16.0.4) patch
- set_tax_regime without permission check at v16.0.3 technical-description
- india-payroll v16.0.4 Release Notes release-notes
- https://github.com/frappe/india-payroll product
- VulnCheck Advisory: Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector third-party-advisory