Éclair 1.10.3: first security audit, 15 flaws fixed
By Thierry Gustin
Published
Updated
6 min read
Contents
Éclair 1.10.3, released on November 3, 2026, fixes everything the first full security audit of Éclair’s code found: 15 confirmed flaws, 3 of them medium, none critical or high, plus 8 leads that depended on the server or the browser. Everything is fixed in the code. If your site runs 1.10, the update takes one click.
What’s new in Éclair 1.10.3?
| Item | What to remember |
|---|---|
| Audit no. 1 | All of the 1.10.2 code reviewed by 86 agents, 50 areas covered |
| Confirmed flaws | 15: 3 medium, 12 low, 0 high, 0 critical |
| Leads needing validation | 8, tied to hosting or the browser, all closed in the code |
| Hardening | More than 50 of the audit’s recommendations applied |
| Automated checks | From 620 to 918, with a real update from 1.10.2 to 1.10.3 tested from GitHub |
| Archive | 619 KB (602 KB in 1.10.2) |
| Your public site | Unchanged: published pages stay identical, byte for byte |
These fixes come right after 1.10.2, released the day before, which I cover further down. The full audit report is online: it is in English, in PDF format, and runs to 18 pages.
How was the audit carried out?
The audit follows Cloudflare’s public security-audit method. It splits the software into areas to cover, then sends out waves of independent “hunter” agents. Every lead they find is then checked again by other agents that did not see it start, before it goes into the report. A lead ends up confirmed, needing validation, or rejected.
For 1.10.2, that gives:
- 86 agents: 4 for reconnaissance, 22 hunters in 5 waves, 6 coverage critics and 54 verifiers;
- 50 areas covered, and a final review that found no gap;
- 24 final records: 15 confirmed flaws, 8 leads needing validation, 1 rejected lead.
All of it was done by reading the code and testing it locally, in a sandbox isolated by the operating system: no network access, dummy data and dummy keys, and no real site probed. Your site was never used as a test bed.
The audit concludes that the code is defensive overall: cryptography, update signing, content cleaning, sessions and form protection hold on most of their paths.
Which flaws were fixed?
First, the three medium flaws:
- The log-out buttons “Log out my other devices” and “Log everyone out” unintentionally renewed the password confirmation. They no longer do.
- Reserved redirects: an editor can no longer redirect
/.well-known/addresses or Éclair’s internal/_eclair/addresses. Existing ones are disabled, and you can delete them. An administrator can still redirect other/.well-known/addresses, such aschange-password. - A cap on content: a site holds at most 3,000 contents, the AI stops creating drafts at 500, and the search index keeps only published text, up to 16 MB. Your existing content always stays editable.
The 12 low flaws mostly concern derived copies and limits that did not keep their promise. A deleted account now disappears from the page cache. A backup never contains the vault (API keys, Google Drive connection), even with a badly written setting. The sending limits of the contact form and the MCP connector are now strict. Finally, update announcements carry a signed serial number and expiry date.
The 8 leads depended on a fact that cannot be observed offline, such as how a host behaves. They are all closed in the code anyway. The report gives no exploitation detail: for each item, it says what was wrong and how it was fixed.
What changes in your admin?
Most fixes are invisible. A few change how you work:
- 🔒 Two-factor authentication: to switch phones, disable 2FA with your current password, then enable it again. This is done in My profile.
- 🔑 Usual devices: after the update, each device becomes “usual” again at its next successful login.
- ☁️ Google Drive: a connection made before 1.10.3 is flagged. Disconnect it, then reconnect it, so Éclair records who set it up.
- 🤖 MCP connector: an app other than Claude or ChatGPT always asks for your password, and the Allow button turns on after a short moment, once you move the mouse or touch the screen.
- ✍️ Editor: the local copy of your unsaved work belongs to the signed-in account and is erased at logout.
- 💾 Contact form: once the 100 messages per day for the whole site are reached, it refuses everyone for 24 hours.
If you use Nginx, update your rules from the guide: media/ no longer serves .js or .mjs files.
What did 1.10.2, released the day before, fix?
1.10.2, released on November 2, 2026, solved two concrete problems.
- o2switch’s antivirus blocked the archive in the file manager. It was a false positive on the one-click update code. File operations now live in a small separate class, and a test checks that no shipped file repeats the suspicious sequence. Your site sees no difference.
- Google Drive opens to every site. The connection relied on Google credentials built into the archive, which were never configured: the card stayed closed. Each site can now use its own Google app. Security › Google Drive backups guides you step by step (free, about ten minutes, once), then you paste the client ID and the client secret. The secret is encrypted on your server.
How do you upgrade to Éclair 1.10.3?
From 1.10.0 or later, the update is done in the admin:
- If several accounts work on your site, save any open edits: unsaved copies from 1.10.2 are not kept.
- Make a backup: Download a backup, or a Google Drive backup.
- Open Admin › Updates, tick the backup box, then click Update.
The update installs the latest available version, which includes these fixes. On 1.9 or earlier? Go through FTP one last time, with the archive from the Download page and the update guide.
Where can you read the full audit report?
The full report is in English, in PDF format, over 18 pages. It describes the method, the sandbox, each flaw with its fix, and the limits of the exercise. It also covers the second audit, run on 1.10.3, and the 1.10.4 release that followed: read the article on Éclair 1.10.4.
Download the audit report (PDF in English, 18 pages)
The report is honest about its limits: it does not claim Éclair is free of defects. The protections are also explained in Éclair’s security, and every version is in the changelog.
Frequently asked questions about Éclair 1.10.3
Was my site attacked?
The audit is not about your site: it examined Éclair’s source code, in a sandbox, with dummy data, and no real site was probed. The flaws it found are fixed in 1.10.3.
Should I install Éclair 1.10.3 right away?
Yes, it is a security release. Make a backup, then open Admin › Updates: the latest version includes these fixes. If several accounts work on your site, save any open edits first.
Where is the audit report, and what language is it in?
The report is in English, an 18-page PDF. You can download it at /assets/site/eclair-cms-security-report-2026-11.pdf. It contains no exploitation detail.
What do I need to do for Google Drive?
If you connected it before 1.10.3, the Security page flags it: disconnect it, then reconnect it. Éclair then records who set up the connection, and removes it if that account is deleted or loses its administrator role.
How much does this update cost?
Nothing: Éclair stays free, under the AGPL-3.0 open-source license, and the update does not use AI. The archive weighs 619 KB, and your public site stays identical.
Read next
Migrate from WordPress to Éclair CMS without losing a URL
Migrate from WordPress to Éclair CMS with Eclair Export: content, images, SEO, menus and redirects carried over, a dry run, then a report for your client.
Éclair 2.3 and Eclair Export 1.1: migrating from WordPress made easy
Éclair 2.3 and Eclair Export 1.1 move a WordPress site in a single transfer: one key, one click, no download and no FTP. Diagrams and a step-by-step guide.
Create a website from A to Z with the Éclair CMS AI Agent
The complete guide to building a pro website with the Éclair CMS AI Agent: each step, the frictions removed, the screenshots and the download link.