Vatican Prayer App Left 700,000 Users' Names and Emails Exposed for Anyone to Grab

Key points

• More than 700,000 Click to Pray user accounts, including names and email addresses, sat exposed on a publicly accessible part of the website with no login needed.
• A volunteer security researcher called BobDaHacker discovered the flaw in January 2025 and struggled to get the Vatican's prayer network to respond.
• The lowest-numbered accounts in the exposed data belong to staff members of the Pope's Worldwide Prayer Network.
• Dark Reading independently confirmed the leak was still live at the time of its reporting.
• Users who signed up with Apple's Hide My Email feature or an abbreviated name were largely protected from the exposure.

The Vatican's official prayer app, Click to Pray, spent months leaking the personal details of more than 700,000 people to the open internet. No browser extensions, no special tools. Just a web browser and the right address.

The app is run by the Pope's Worldwide Prayer Network and lets Catholics around the world follow daily prayers and papal content on their phones or computers. Signing up requires a first name, last name, email address, country, and a password. Straightforward enough. The problem was what happened to that data on the server side.

How did the leak work?

Every account created on the site gets a sequential user ID, a numbered label assigned in order. A flaw called an insecure direct object reference, or IDOR, meant that anyone who knew the site's internal data interface could type a user ID into a web address and instantly read that account's name, email, and country. Change the number, get a different person's details. Repeat for all 700,000-plus accounts.

That internal data interface is called an API endpoint: a specific address on a web server meant to hand information to authorised software only. This one handed it to everybody.

The failure mode here is painfully common, and we reported a close cousin of it in July when an independent researcher found a similar authorisation gap inside Meta's support system. Most software frameworks check whether someone is logged in. They don't automatically check whether that person should be allowed to see a specific record. That second check is the developer's job, and under deadline pressure it gets skipped.

BobDaHacker put it plainly: "Broken Access Control has been the number one vulnerability category in the OWASP Top 10 since 2021," referring to the widely followed list of critical web security risks, "and IDOR is probably the single most common flavour of it."

Any criminal who found this endpoint could have downloaded all 700,000 records with a simple automated script, then sent convincing emails to every user impersonating the Pope's Worldwide Prayer Network, perhaps to solicit donations or harvest login details.

Should users be worried?

If you signed up with your real name and email, your details were exposed. The immediate risk is targeted phishing: fake emails impersonating a trusted sender to trick you into clicking a malicious link or handing over money. Members who used Apple's Hide My Email, which gives websites a scrambled relay address instead of your real one, or who registered with an abbreviated name, have meaningful protection here.

Be sceptical of any unexpected email claiming to come from the network, especially one asking for a password reset or personal information. The Vatican issued its own internal data protection rules on 30 April 2024 as Decree No. DCLVII, but those rules haven't translated into a secure app yet.

Using a unique email alias per service isn't just a privacy preference; it's a first line of defence when the service itself can't be trusted to protect your data. La Machi Communication for Good Causes, the Spanish-language agency that built the app, hadn't responded to Dark Reading's request for comment at the time of publication.