# Saleor 3.20.118 — Release & Upgrade Intelligence
- **Product:** Saleor (https://saleor.io)
- **Version:** 3.20.118
- **Released:** Apr 08, 2026
- **Impact Score:** 7/10
- **Breaking Changes:** Source flagged
- **Canonical Analysis:** https://changelogs.us/saleor/updates/3.20.118/

## Executive Summary (TL;DR)
Saleor 3.20.118. Source highlight: Fixed CVE-2026-33756: Denial of service via unbounded GraphQL query batching

## Breaking Changes & Deprecations
- Potential breaking changes are included: > > - If you use GraphQL query batching, the environment variable `GRAPHQL_BATCH_MAX_COUNT` should be increased. By default it is set to `1`, meaning only 1 query can be sent inside a single batch. You need to audit your usages and choose the correct value for your use-case.

## Bug Fixes
- Fixed CVE-2026-33756: Denial of service via unbounded GraphQL query batching
- Fixed CVE-2026-35401: Resource exhaustion vulnerability in GraphQL queries
- Fixed CVE-2026-35407: Cross-account email change via unbound confirmation token
- Fixed CVE-2026-39851: User enumeration vulnerability due to different error messages