Vatican Prayer App Left 700,000 Users' Names and Emails Exposed for Anyone to Grab

Key points

• More than 700,000 Click to Pray user accounts, including names and email addresses, sat exposed on a publicly accessible part of the website with no password or login needed.
• A volunteer security researcher called BobDaHacker discovered the flaw in January and struggled to get the Vatican's prayer network to respond.
• The lowest-numbered accounts in the exposed data belong to staff members of the Pope's Worldwide Prayer Network.
• Dark Reading independently confirmed the leak was still live at the time of its reporting.
• Users who signed up with Apple's Hide My Email feature or a fake name were largely protected from the exposure.

The Vatican's official prayer app, Click to Pray, spent months leaking the personal details of more than 700,000 people to the open internet. No hacking tools needed. No stolen passwords. Just a web browser and the right address.

The app is run by the Pope's Worldwide Prayer Network and lets Catholics around the world follow daily prayers and papal content on their phones or computers. Signing up asks for a first name, last name, email address, and country. Straightforward enough. The problem was what happened to that data on the server side.

How did the leak work?

Every account created on the site gets a sequential user ID, basically a numbered label assigned in order. A flaw called an insecure direct object reference, or IDOR, meant that anyone who knew how the site's internal data interface worked could type a user ID into a web address and instantly read that person's name, email, and country. Change the number, get a different person's details. Repeat for all 700,000-plus accounts.

That internal data interface is called an API endpoint, meaning a specific address on a web server that is supposed to hand information to authorised software only. This one handed it to everybody.

The failure mode here is painfully common. Most software frameworks check whether someone is logged in. They do not automatically check whether a logged-in or anonymous user should be allowed to see a specific record. That second check is the developer's job to add, and under deadline pressure it often gets skipped.

BobDaHacker, who discovered the flaw, put it plainly: "Broken Access Control has been the number one vulnerability category in the OWASP Top 10 since 2021," referring to the widely followed list of the most critical web security risks, "and IDOR is probably the single most common flavour of it."

In practice, any criminal who found this endpoint could have downloaded all 700,000 records with a simple automated script, then sent convincing-looking emails to every user pretending to be the Pope's Worldwide Prayer Network, perhaps asking for donations or login details.

Should users be worried?

If you signed up with your real name and email, your details were exposed. The immediate risk is targeted phishing, where criminals send fake emails impersonating a trusted sender to trick you into clicking a malicious link or handing over money. Members who used Apple's Hide My Email feature, which gives websites a scrambled relay address instead of your real one, or who signed up with an abbreviated name, have meaningful protection here.

If you have a Click to Pray account, be sceptical of any unexpected email claiming to come from the network, especially one asking for a donation, a password reset, or personal information. The Vatican issued its own internal data protection rules in April 2024 as Decree No. DCLVII, but those rules clearly have not translated into a secure app yet.

One operational takeaway: using a unique email alias per service is not just a privacy nice-to-have, it is a first line of defence when the service itself cannot be trusted to protect your data.