# What changed in @payloadcms/ui

> 15 changes in @payloadcms/ui 3 from its official release notes, upgrade guides and advisories: 15 security. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/@payloadcms/ui/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @payloadcms/ui 3

### Security

- Payload: Client uploads could overwrite S3 objects (3.90.0) — [security advisory](https://github.com/advisories/GHSA-7VG8-29QX-JGJ8)
- Payload Ecommerce has an order confirmation validation issue (3.90.0) — [security advisory](https://github.com/advisories/GHSA-8R29-2MP2-PMRW)
- Payload Form Builder has an RCE issue (3.90.0) — [security advisory](https://github.com/advisories/GHSA-R488-J9VJ-WX3Q)
- Payload has a tenant authorization bypass in Multi-Tenant Plugin (3.90.0) — [security advisory](https://github.com/advisories/GHSA-P96C-XWX8-3CQJ)
- Payload: Insufficient Access Control in Stripe REST Proxy (3.90.0) — [security advisory](https://github.com/advisories/GHSA-R9V2-GG2J-22Q5)
- @payloadcms/plugin-multi-tenant has a cross-tenant create issue (3.90.0) — [security advisory](https://github.com/advisories/GHSA-XHM9-GWGW-3Q2Q)
- Payload: Improper access control for MCP API keys (3.88.0) — [security advisory](https://github.com/advisories/GHSA-2Q76-M6W6-QGC6)
- Payload: Prototype pollution in Payload Import Export plugin (3.88.0) — [security advisory](https://github.com/advisories/GHSA-QF28-8HC6-VWRP)
- Payload: Untrusted redirect URL parameter exploit (3.88.0) — [security advisory](https://github.com/advisories/GHSA-W84C-53H3-MC2G)
- Payload: Field-level write access bypass in Payload on MongoDB (3.87.0) — [security advisory](https://github.com/advisories/GHSA-4WW4-68Q3-H7G5)
- Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery (3.79.1) — [security advisory](https://github.com/advisories/GHSA-HP5W-3HXX-VMWF)
- Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints (3.78.0) — [security advisory](https://github.com/advisories/GHSA-FRQ9-7J6G-V74X)
- @payloadcms/next has Stored XSS in Admin Panel (3.78.0) — [security advisory](https://github.com/advisories/GHSA-MMXC-95CH-2J7C)
- Payload: SQL injection in SQLite/Postgres (3.73.0) — [security advisory](https://github.com/advisories/GHSA-PJ7X-6WPF-PGVP)
- @payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters (3.73.0) — [security advisory](https://github.com/advisories/GHSA-XX6W-JXG9-2WH8)