---
id: "CVE-2026-129429"
page: "https://infrastack.ai/live/CVE-2026-129429"
kind: "vulnerability"
aliases: ["CVE-2026-129429"]
title: "Frappe india-payroll: low-privileged users can read other employees' pay"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erpnext", "frappe", "india-payroll", "package", "self-hosted"]
not_affected_if: ["app-not-installed", "no-untrusted-logins"]
published_at: "2026-11-14T13:17:22+00:00"
first_seen_at: "2026-11-14T13:28:09+00:00"
updated_at: "2026-11-14T13:29:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129429", "first_seen_at": "2026-11-14T13:28:09+00:00"}]
exploit_sources: []
---

# Frappe india-payroll: low-privileged users can read other employees' pay

Link for people: https://infrastack.ai/live/CVE-2026-129429 (this .md is for agents)

The india-payroll app for Frappe has missing authorization checks in three tax regime methods. An logged-in low-privileged user can pass another employee's ID to read base pay and salary components, or change the tax regime on draft salary assignments.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `india-payroll` version in the Frappe bench; versions below `16.0.4` are affected.
- Look for `tax_regime_selector.py` and confirm the `get_employee_details`, `compute_tax_comparison` and `set_tax_regime` methods.

## Fix

- `india-payroll` to `16.0.4` or later (per the advisory's before-16.0.4 range).

## Timeline

- 2026-11-14T13:28:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129429

## Documents

- [advisory] Vendor advisory: github.com https://github.com/frappe/india-payroll/security/advisories/GHSA-758f-34xj-xvcc
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frappe-india-payroll-before-16.0.4-missing-authorization-via-tax-regime-selector
- [fix] Patch: github.com https://github.com/frappe/india-payroll/commit/78de736298a340ecb971826a5df10e7204773cef
- [fix] Patch: github.com https://github.com/frappe/india-payroll/commit/bdb988f172663db4054f9c3fc23833f10c3b60b0
- [fix] Release notes: github.com https://github.com/frappe/india-payroll/releases/tag/v16.0.4

## From the sources

Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another employee identifier to read base pay and earning and deduction components, or change the tax regime on draft Salary Structure Assignments to affect tax withholding.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_