CVE-2026-129429: Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector

Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the getemployeedetails, computetaxcomparison and settaxregime methods of taxregimeselector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another employee identifier to read base pay and earning and deduction components, or change the tax regime on draft Salary Structure Assignments to affect tax withholding.