Vatican's Click to Pray App Leaked 700,000+ Users' Data for Six Months Before Being Quietly Fixed
An unauthenticated API flaw in the Pope's official prayer app exposed names, emails, and birth dates of over 719,000 users for six months before a fix.
Overview
Click To Pray, the official prayer app of the Pope’s Worldwide Prayer Network, exposed the personal data of more than 700,000 users for roughly six months through an unauthenticated API flaw, according to Malwarebytes. The app, launched by Pope Francis in 2019 and developed by La Machi Communication for Good Causes for the Pope’s Worldwide Prayer Network, according to Malwarebytes, had 719,517 registered accounts as of July 2026, according to The Register.
What We Know
Independent researcher BobDaHacker discovered the flaw in January 2026 and reported it to the Pope’s Worldwide Prayer Network on January 3, 2026, according to Malwarebytes, emailing nine addresses spanning the Click To Pray service and the prayer network without receiving a response, according to Malwarebytes. The vulnerability was only fixed more than six months later, after the researcher contacted a journalist who filed a query with the Vatican, according to Malwarebytes.
The flaw is an Insecure Direct Object Reference (IDOR), a common access-control bug that occurs when an application returns data for a requested ID without checking whether the requester is authorized to see it, according to The Register. Each Click To Pray account was assigned a sequential numeric user ID, and the app’s API endpoint would return that user’s record for any valid ID supplied — no login or ownership check required, according to The Register. Exposed data included users’ first and last names, email addresses, country, and date of birth, according to Malwarebytes, along with account-deletion status and each account’s assigned role, according to Cyber Security News. Ordinary users were assigned a “PRAYER” role, while the lowest-numbered accounts were reportedly associated with staff, according to Cyber Security News.
“You ask for your own data, the server gives it to you,” BobDaHacker said. “You ask for someone else’s data, the server gives you that too. Thou shalt not authorize, apparently,” according to The Register. With no rate limiting on the endpoint, an attacker could have enumerated every one of the 719,517 accounts with a simple script, according to The Register.
A second flaw compounded the exposure. The service’s signup endpoint returned a “validation_hash” value directly in its response — the same code normally sent to a user’s inbox to verify their email address, according to The Register. That meant someone could register an account using an email address they did not control and verify it themselves before the real owner ever saw the confirmation message, according to Malwarebytes. BobDaHacker also found that Click To Pray’s verification emails failed standard domain authentication checks, which could make it easier for attackers to impersonate the service, according to Malwarebytes.
Because the exposed data required nothing more than a web browser to retrieve, attackers would not have needed advanced technical skills to collect it, according to Cyber Security News, which noted the exposure illustrates the kind of broken access control that OWASP’s Top 10 guidance identifies as a major web application risk, recommending least-privilege access and default-deny authorization checks, according to Cyber Security News. BobDaHacker warned that many Click To Pray users are likely older and especially trusting of anything Vatican-affiliated, calling the exposed list a “phishing goldmine,” according to The Register. “Imagine getting an email that says ‘The Holy Father requests your urgent attention’ with a Vatican-looking link,” she said. “Grandma is clicking that. Every time,” according to The Register.
This is not the first security lapse tied to a Vatican-affiliated app. In 2019, UK firm Fidus Information Security found a flaw in the app for the Vatican’s Bluetooth eRosary device that similarly exposed a login credential in plain text within a web response, according to Malwarebytes. Malwarebytes also noted that Vatican City State introduced its own data protection regulation, Decree No. DCLVII, on April 30, 2024, though it is unclear whether the rule applies directly to Click To Pray or the organizations that operate it, according to Malwarebytes.
The flaws have since been fixed, according to Malwarebytes. The Register said it reached out to the Pope’s Worldwide Prayer Network for comment and did not receive a response, according to The Register.
What We Don’t Know
It is not confirmed whether any malicious actor exploited the flaw to scrape user data before it was fixed, or whether affected users have been notified directly by the Vatican or Click To Pray. It also remains unclear whether Vatican City State’s Decree No. DCLVII data protection rule formally covers Click To Pray’s operations, a point Malwarebytes itself flagged as unresolved.
Analysis
The six-month gap between disclosure and fix underscores a recurring theme in vulnerability reporting: technical severity often matters less than whether an organization has a functioning intake process for security reports. BobDaHacker’s nine unanswered emails, sent to a mix of service and general contact addresses, went nowhere until media attention forced a response — a pattern security researchers have flagged repeatedly when organizations lack a published vulnerability disclosure policy or dedicated security contact.