{"id":"CVE-2026-129429","kind":"vulnerability","aliases":["CVE-2026-129429"],"related":[],"title":"Frappe india-payroll: low-privileged users can read other employees' pay","description":"Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another employee identifier to read base pay and earning and deduction components, or change the tax regime on draft Salary Structure Assignments to affect tax withholding.","summary":"The india-payroll app for Frappe has missing authorization checks in three tax regime methods. An logged-in low-privileged user can pass another employee's ID to read base pay and salary components, or change the tax regime on draft salary assignments.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe","india-payroll","package","self-hosted"],"not_affected_if":["app-not-installed","no-untrusted-logins"],"how_to_check":"- Check the installed `india-payroll` version in the Frappe bench; versions below `16.0.4` are affected.\n- Look for `tax_regime_selector.py` and confirm the `get_employee_details`, `compute_tax_comparison` and `set_tax_regime` methods.","fix":"- `india-payroll` to `16.0.4` or later (per the advisory's before-16.0.4 range).","status":"open","published_at":"2026-11-14T13:17:22+00:00","first_seen_at":"2026-11-14T13:28:09+00:00","triaged_at":"2026-11-14T13:29:03+00:00","updated_at":"2026-11-14T13:29:03+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-14T13:29:03Z","model":"claude-haiku-5-5","output":{"fix":"- `india-payroll` to `16.0.4` or later (per the advisory's before-16.0.4 range).","reach":"network","title":"Frappe india-payroll: low-privileged users can read other employees' pay","impact":"medium","summary":"The india-payroll app for Frappe has missing authorization checks in three tax regime methods. An logged-in low-privileged user can pass another employee's ID to read base pay and salary components, or change the tax regime on draft salary assignments.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe","erpnext","india-payroll","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Other employees' salary data readable and tax regime changed","analyst_note":"","how_to_check":"- Check the installed `india-payroll` version in the Frappe bench; versions below `16.0.4` are affected.\n- Look for `tax_regime_selector.py` and confirm the `get_employee_details`, `compute_tax_comparison` and `set_tax_regime` methods.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["app-not-installed","no-untrusted-logins"],"who_is_affected":"Companies running the india-payroll app on Frappe or ERPNext where employees have logins with limited roles. Exposure depends on those users being able to reach the payroll methods; installations without the app can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4683,"output_tokens":543,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129429':16A,19A '-2026':15A,18A '16.0.4':80C 'access':109C 'affect':140C 'allow':102C 'anoth':55B,117C 'app':33B 'assign':74B,138C 'attack':114C 'authent':103C 'author':38B,84C 'base':61B,122C 'chang':67B,130C 'check':39B 'comparison':93C 'compon':65B,128C 'comput':91C 'contain':81C 'cve':14A,17A 'data':113C 'deduct':127C 'detail':90C 'draft':72B,135C 'earn':125C 'employe':12A,56B,89C,111C,118C 'erpnext':20B 'frapp':1A,21B,35B,75C 'get':88C 'host':28B 'id':58B 'identifi':119C 'india':3A,23B,31B,77C 'india-payrol':2A,22B,30B,76C 'log':47B 'logged-in':46B 'low':6A,50B,105C 'low-privileg':5A,49B,104C 'method':44B,98C 'miss':37B,83C 'packag':25B 'pass':54B 'pay':13A,62B,123C 'payrol':4A,24B,32B,78C,112C 'privileg':7A,51B,106C 'read':10A,60B,121C 'regim':43B,70B,97C,133C 'salari':64B,73B,136C 'self':27B 'self-host':26B 'set':95C 'structur':137C 'suppli':116C 'tax':42B,69B,92C,96C,132C,141C 'tax_regime_selector.py':100C 'three':41B 'user':8A,52B,107C 'vulner':85C 'withhold':142C","nicknames":[],"mitigations":[],"who_affected":"Companies running the india-payroll app on Frappe or ERPNext where employees have logins with limited roles. Exposure depends on those users being able to reach the payroll methods; installations without the app can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erpnext","frappe","high","indiapayroll","package","selfhosted"],"campaign_type":null,"search_a":"'-129429':16A,19A '-2026':15A,18A 'cve':14A,17A 'employe':12A 'frapp':1A 'india':3A 'india-payrol':2A 'low':6A 'low-privileg':5A 'pay':13A 'payrol':4A 'privileg':7A 'read':10A 'user':8A","search_b":"'anoth':55B 'app':33B 'assign':74B 'author':38B 'base':61B 'chang':67B 'check':39B 'compon':65B 'draft':72B 'employe':56B 'erpnext':20B 'frapp':21B,35B 'host':28B 'id':58B 'india':23B,31B 'india-payrol':22B,30B 'log':47B 'logged-in':46B 'low':50B 'low-privileg':49B 'method':44B 'miss':37B 'packag':25B 'pass':54B 'pay':62B 'payrol':24B,32B 'privileg':51B 'read':60B 'regim':43B,70B 'salari':64B,73B 'self':27B 'self-host':26B 'tax':42B,69B 'three':41B 'user':52B","search_c":"'16.0.4':80C 'access':109C 'affect':140C 'allow':102C 'anoth':117C 'assign':138C 'attack':114C 'authent':103C 'author':84C 'base':122C 'chang':130C 'comparison':93C 'compon':128C 'comput':91C 'contain':81C 'data':113C 'deduct':127C 'detail':90C 'draft':135C 'earn':125C 'employe':89C,111C,118C 'frapp':75C 'get':88C 'identifi':119C 'india':77C 'india-payrol':76C 'low':105C 'low-privileg':104C 'method':98C 'miss':83C 'pay':123C 'payrol':78C,112C 'privileg':106C 'read':121C 'regim':97C,133C 'salari':136C 'set':95C 'structur':137C 'suppli':116C 'tax':92C,96C,132C,141C 'tax_regime_selector.py':100C 'user':107C 'vulner':85C 'withhold':142C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-17T04:21:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129429","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129429","severity":null,"published_at":"2026-11-14T13:17:22+00:00","modified_at":"2026-11-14T13:17:22+00:00","first_seen_at":"2026-11-14T13:28:09+00:00","fetched_at":"2026-11-14T13:28:09+00:00","note":null}],"documents":[{"id":155839,"url":"https://github.com/frappe/india-payroll/commit/78de736298a340ecb971826a5df10e7204773cef","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":155840,"url":"https://github.com/frappe/india-payroll/commit/bdb988f172663db4054f9c3fc23833f10c3b60b0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":155841,"url":"https://github.com/frappe/india-payroll/releases/tag/v16.0.4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":155842,"url":"https://github.com/frappe/india-payroll/security/advisories/GHSA-758f-34xj-xvcc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-17T04:21:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":155843,"url":"https://www.vulncheck.com/advisories/frappe-india-payroll-before-16.0.4-missing-authorization-via-tax-regime-selector","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}