Technical impact
The flaw is a missing authorization check in the get_employee_details, compute_tax_comparison, and set_tax_regime methods of the tax_regime_selector module. When an authenticated user calls these methods, the system does not verify that the requestor has permission to view or modify the target employee’s payroll information. Consequently, an attacker can read sensitive data such as base pay, earnings, deductions, and can also change the tax regime on a draft Salary Structure Assignment, potentially altering tax withholding for other employees.
Affected Systems
Any deployment of Frappe india-payroll earlier than version 16.0.4 is vulnerable. The issue resides in the tax_regime_selector component, which is part of the core India payroll application.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity vulnerability. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog. Because the vulnerability requires the user to be authenticated, an attacker must first obtain valid credentials or compromise a low‑privileged account. Once authenticated, the attacker can supply an employee identifier to retrieve payroll details or alter tax settings, thus compromising confidentiality and potentially affecting tax calculations. Exploitation would involve making crafted requests to the affected endpoints, and the potential damage ranges from data disclosure to financial mis‑reporting.
