Vatican-Endorsed App Leaks User Profiles

A digital platform designed to facilitate spiritual connection has instead become a source of privacy concern. Click To Pray, the official application for the Pope's Worldwide Prayer Network, has been found to harbor a significant security flaw that exposes the personal identifiers of its massive user base.

The Mechanics of the Vulnerability

The security issue centers on an Insecure Direct Object Reference (IDOR) bug. This type of flaw occurs when an application fails to properly verify if a user has the appropriate permission to access specific data objects requested via an API. In this case, the application's backend blindly accepts input from users, providing access to records that should remain private.

Researchers identified that by targeting the API endpoint, an unauthorized party can retrieve sensitive account details simply by iterating through sequential user IDs. Because the system lacks authorization checks or rate limiting, the entire database of 719,517 registered accounts is effectively open to automated scraping.

The vulnerability is still live. Nobody has ever responded. I guess my email wasn't in their prayers.

— BobDaHacker, independent security researcher

Scope of the Exposed Data

The breach of personal information is comprehensive, covering several categories of user data that could be leveraged by malicious actors. According to reports, the exposed records include the following:

• User names and email addresses
• Country of origin
• Dates of birth
• Account status, including deletion history

Failure of Email Authentication

Beyond the IDOR vulnerability, the application presents additional risks regarding communication security. The signup process exposes validation hashes, potentially allowing unauthorized account verification. Furthermore, legitimate emails sent by the platform appear to fail basic domain authentication requirements, which might lead users to believe they are receiving spoofed messages.

Implications for Trust

The intersection of a high-trust platform and insecure infrastructure creates a significant environment for potential social engineering attacks. Because many users may perceive an app affiliated with the Vatican as inherently secure, they may be more susceptible to phishing campaigns that impersonate official entities. The absence of response from the organization regarding the disclosed vulnerability suggests that these exposed accounts may remain at risk, highlighting the broader consequences for organizations that do not prioritize the maintenance of their digital infrastructure alongside their public-facing mission.