{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-129429", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-14T12:15:38.215Z", "datePublished": "2026-11-14T12:32:55.388Z", "dateUpdated": "2026-11-14T12:32:55.388Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-14T12:32:55.388Z"}, "datePublic": "2026-09-17T00:00:00.000Z", "title": "Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector", "descriptions": [{"lang": "en", "value": "Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another employee identifier to read base pay and earning and deduction components, or change the tax regime on draft Salary Structure Assignments to affect tax withholding."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "affected": [{"vendor": "frappe", "product": "india-payroll", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "16.0.4"}, {"version": "16.0.4", "status": "unaffected", "versionType": "semver"}], "packageURL": "pkg:github/frappe/india-payroll"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/frappe/india-payroll/security/advisories/GHSA-758f-34xj-xvcc", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-758f-34xj-xvcc)"}, {"url": "https://github.com/frappe/india-payroll/commit/78de736298a340ecb971826a5df10e7204773cef", "tags": ["patch"], "name": "Patch Commit (develop)"}, {"url": "https://github.com/frappe/india-payroll/commit/bdb988f172663db4054f9c3fc23833f10c3b60b0", "tags": ["patch"], "name": "Patch Commit (v16.0.4)"}, {"url": "https://github.com/frappe/india-payroll/blob/9c1fc91b34de8a55df58aa5f2dbabff95dedb4d1/india_payroll/india_payroll/page/tax_regime_selector/tax_regime_selector.py#L207-L215", "tags": ["technical-description"], "name": "set_tax_regime without permission check at v16.0.3"}, {"url": "https://github.com/frappe/india-payroll/releases/tag/v16.0.4", "tags": ["release-notes"], "name": "india-payroll v16.0.4 Release Notes"}, {"url": "https://github.com/frappe/india-payroll", "tags": ["product"]}, {"name": "VulnCheck Advisory: Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/frappe-india-payroll-before-16.0.4-missing-authorization-via-tax-regime-selector"}], "credits": [{"lang": "en", "value": "Darshan U", "type": "finder"}, {"lang": "en", "value": "asmitahase", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/frappe/india-payroll", "product": "india-payroll", "vendor": "frappe", "versions": [{"lessThan": "16.0.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "16.0.4", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another employee identifier to read base pay and earning and deduction components, or change the tax regime on draft Salary Structure Assignments to affect tax withholding."}], "id": "CVE-2026-129429", "lastModified": "2026-11-14T13:17:22.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-14T13:17:22.243", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/frappe/india-payroll"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/frappe/india-payroll/blob/9c1fc91b34de8a55df58aa5f2dbabff95dedb4d1/india_payroll/india_payroll/page/tax_regime_selector/tax_regime_selector.py#L207-L215"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/frappe/india-payroll/commit/78de736298a340ecb971826a5df10e7204773cef"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/frappe/india-payroll/commit/bdb988f172663db4054f9c3fc23833f10c3b60b0"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/frappe/india-payroll/releases/tag/v16.0.4"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/frappe/india-payroll/security/advisories/GHSA-758f-34xj-xvcc"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/frappe-india-payroll-before-16.0.4-missing-authorization-via-tax-regime-selector"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}

{}