Saleor allows a client to batch multiple GraphQL operations in a single HTTP request as a JSON array. No upper limit was enforced on the number of operations, which meant an unauthenticated user could submit a single request containing many operations. This bypasses the per‑query complexity limit and can exhaust server resources, leading to degraded performance or a complete denial of service. The weakness is categorized as unbounded resource consumption (CWE‑770).

The vulnerability affects the Saleor e‑commerce platform. All releases from 2.0.0 up to, but not including, 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118 are susceptible. Those specific releases have been patched to restrict the maximum number of batched operations.

The CVSS score of 7.5 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that while the condition is not currently widely exploited, it could be leveraged by an attacker with minimal effort. The likely attack vector is an unauthenticated external request, so any system exposed to public traffic could be targeted. Exploiting this requires no special authentication or privilege and only involves sending a crafted batch request to the GraphQL endpoint.