A Vulnerability in the Vatican’s Official Prayer App Exposes Hundreds of Thousands of Users’ Personal Data
The Vatican’s official prayer app, Click to Pray, has been leaking sensitive information about its users, including their names and email addresses, due to a security vulnerability. The issue affects over 700,000 global users who have signed up for access to daily prayers and papal content on their phones or computers.
Click to Pray is a popular app that allows users to sign up for various prayer programs, receive daily prayers, and stay updated with the Pope’s messages. However, an exposed API endpoint has made it possible for anyone with a browser to access sensitive information about users, including their names, email addresses, country of origin, and even whether their account has been deleted or has administrative privileges.
According to reports, a white-hat hacker discovered the vulnerability in January and attempted to notify the Pope’s Worldwide Prayer Network, which manages the app. However, efforts to address the issue were unsuccessful, leading the hacker to share the information with Dark Reading, a cybersecurity publication that independently confirmed the vulnerability.
The exposed API endpoint is a result of an insecure direct object reference (IDOR) flaw, a common type of vulnerability where sensitive data is made accessible without proper authorization checks. This can be exploited by attackers using simple scripts to scrape user data and carry out malicious activities such as mass emailing or social engineering.
Users who have signed up for the app may not even realize they are at risk. For instance, email addresses and names are leaked in plaintext, making it easy for attackers to exploit this information. The vulnerability is also not limited to users; administrative and staff accounts associated with Click to Pray are also exposed, posing a significant security risk.
The discovery of the vulnerability highlights the importance of proper authorization checks in web applications. “IDORs are incredibly common,” says BobDaHacker, the white-hat hacker who discovered the issue. “Broken Access Control has been the number one vulnerability category in the OWASP Top 10 since 2021, and IDOR is probably the single most common flavor of it.”
To protect themselves from similar vulnerabilities, users should consider anonymizing their information during account registration or using features like Apple’s “Hide my Email” to mask their email addresses. Developers can also learn from this example by prioritizing proper authorization checks in their applications to prevent such security flaws.
In the meantime, Click to Pray’s users are advised to be cautious when receiving unsolicited emails or messages that claim to be from the Pope’s Worldwide Prayer Network or other official entities. By being aware of these risks and taking proactive measures to secure their personal data, users can minimize the impact of this vulnerability and ensure a safer online experience.
Source: Dark Reading — 2026-07-24