A major vulnerability in the Vatican’s official prayer app, Click to Pray, has exposed the personal data of over 700,000 users worldwide. The app, used by people in nearly every country on the planet, allows users to sign up for daily prayers and access papal content through a website or mobile app. However, an insecure API endpoint has been discovered, allowing anyone with a browser to easily obtain sensitive information such as names, email addresses, countries of origin, and site status.
The vulnerability was first identified by white hat hacker BobDaHacker in January, but it remains live to this day. To exploit the issue, an attacker simply needs to query the exposed API endpoint using any user ID. This can be done with no technical skill required, just a basic understanding of how the internet works. The leak includes not only user information but also details about administrative and staff accounts.
The affected data is extensive, with over 700,000 user accounts being freely available. The lowest-numbered user IDs are associated with Click to Pray staff, making it clear that even those closest to the app’s inner workings were unaware of the vulnerability. Email addresses and names are exposed in plaintext, while countries of origin are assigned numerical values. Each listing also indicates whether the associated account has been deleted or possesses administrative privileges.
The severity of this issue cannot be overstated. An attacker could easily scrape all the leaked data using a simple script, then use it to launch targeted phishing attacks or other social engineering schemes. The app’s users may have unwittingly provided sensitive information that can now be used against them.
IDORs (Insecure Direct Object Reference) like this one are extremely common and often arise from neglecting authorization controls during development. As BobDaHacker notes, “most frameworks handle authentication for you but don’t handle authorization.” Developers must implement additional checks to verify whether a user should have access to specific resources, which is surprisingly easy to overlook when working under tight deadlines.
The Pope’s Worldwide Prayer Network and the communications company La Machi, which developed the app, have yet to respond to requests for comment. In the meantime, users can take steps to protect themselves by anonymizing their account registration information. Many Click to Pray users already employ this strategy, providing abbreviated names or alphanumeric handles instead of their actual identities.
For those who have not taken similar precautions, it’s essential to be cautious about sharing sensitive information online. Always use strong passwords and consider enabling features like Apple’s “Hide my Email” when creating accounts on third-party services. By being vigilant and taking control of our own data security, we can mitigate the risks associated with insecure apps and protect ourselves from potential harm.
Source: Dark Reading — 2026-07-24