The Vatican’s official Click to Pray app has exposed the personal information of more than 700,000 users through an unauthenticated API flaw.
The issue allowed anyone with a web browser to retrieve account data without needing to sign in. Click to Pray offers daily prayers and papal content through its website and mobile applications.
Users provided names, email addresses, passwords, and sometimes their country when creating accounts, creating a large pool of data that should have been protected.
Analysts at DarkReading identified the exposure after ethical hacker BobDaHacker discovered an insecure direct object reference, or IDOR, vulnerability in January.
DarkReading independently tested the issue and reported that it remained accessible at the time of publication.
DarkReading said in a report shared with Cyber Security News (CSN) that the case is not a malware incident, but it highlights how a simple access-control failure can expose users to phishing, impersonation, and other targeted scams.
Unauthenticated API Exposes User Records
The vulnerable API assigned each Click to Pray account a sequential user ID. By supplying a valid ID to the exposed endpoint, an unauthenticated visitor could view information linked to that account and then repeat the process across a wide range of users.
The exposed records included users’ first and last names, email addresses, country identifiers, account-deletion status, and assigned roles.
The lowest-numbered accounts were reportedly associated with staff, while ordinary users were marked with the “PRAYER” role.
This kind of weakness is commonly known as an IDOR flaw because an application exposes an object reference, such as a user ID, without confirming whether the requester is allowed to access it.
A previously reported broken object authorization flaw similarly showed how missing authorization controls can place private information at risk.
Sequential identifiers make large-scale collection especially easy. An attacker could use a simple script to cycle through account numbers, gather records in bulk, and build a list of individuals who may trust messages that appear to come from the Vatican or its prayer network.
The report said attackers would not need advanced technical skills to access the data.
The information was available through a browser request, lowering the barrier for criminals who want to prepare convincing phishing campaigns or social-engineering lures.
Organizations handling personal data need to ensure that every API request checks both identity and permission.
The issue mirrors an IDOR flaw in ExHub, where insufficient authorization checks enabled access beyond a user’s intended privileges.
Phishing Risks and Security Lessons
Names and email addresses can make fraudulent emails appear more credible, particularly when criminals use references to faith, prayer requests, donations, or Vatican content.
Victims may be more likely to open messages when attackers can personalize them with real account details.
The exposure also demonstrates why broken access control remains a serious web security concern.
The OWASP Top 10 guidance identifies broken access control as a major application risk and recommends enforcing least-privilege access, denying access by default, and applying strong authorization checks.
BobDaHacker noted that many development frameworks handle authentication but do not automatically decide whether a logged-in person should access a particular record.
Developers must build that second authorization check into every sensitive feature and API endpoint.
For users, the report recommends limiting the personal information shared during registration where possible.
Some Click to Pray users used abbreviated names, alphanumeric handles, or Apple’s Hide My Email feature, which can reduce the value of exposed data by substituting a relay address for a real inbox.
People who used their real contact details should be cautious of unexpected emails that claim to represent the Vatican, Click to Pray, or the Pope’s Worldwide Prayer Network.
They should avoid clicking links or sharing passwords until they independently verify the sender through an official channel. Similar risks were highlighted in the NVIDIA personal data breach, where exposed identifiers could also support targeted phishing and credential attacks.
The incident is a reminder that non-technical organizations still carry major security responsibilities when they collect data at scale.
Security reviews, API authorization testing, and a clear process for handling vulnerability reports are essential protections for any organization that stores user information.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Domain | clicktopray.org | Click to Pray domain where the exposed API vulnerability was identified. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
