CVE-2026-129429

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-129429
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129429.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-129429
Aliases
  • GHSA-758f-34xj-xvcc
Published
2026-11-14T12:32:55Z
Modified
2026-11-15T02:46:40Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector
Details

Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another employee identifier to read base pay and earning and deduction components, or change the tax regime on draft Salary Structure Assignments to affect tax withholding.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129429.json"
}
References

Affected packages

Git / github.com/frappe/india-payroll

Affected ranges

Type
GIT
Repo
https://github.com/frappe/india-payroll
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2f033e4a37931ec6859d81b84b60666511665bba
Fixed
78de736298a340ecb971826a5df10e7204773cef
Fixed
bdb988f172663db4054f9c3fc23833f10c3b60b0
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "16.0.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "78de736298a340ecb971826a5df10e7204773cef"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "bdb988f172663db4054f9c3fc23833f10c3b60b0"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v16.0.4",
            "range": [
                {
                    "fixed": "2f033e4a37931ec6859d81b84b60666511665bba"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v16.*
v16.0.0
v16.0.1
v16.0.2
v16.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129429.json"