Threats affecting pkg:github/india-payroll

CVE-2026-129429 is a missing authorization vulnerability in the frappe india-payroll software versions before 16.0.4. It affects the get_employee_details, compute_tax_comparison, and set_tax_regime methods in tax_regime_selector.py. Authenticated low-privileged users can exploit this flaw to access payroll data of other employees, including base pay and earning and deduction components. They can also alter the tax regime on draft Salary Structure Assignments, potentially impacting tax withholding. The vulnerability has a high severity score of 7.1 and was fixed in version 16.0.4.