Vatican’s Click To Pray App Exposed User Data Due to API Flaws
A security vulnerability in Click To Pray, a prayer app launched by Pope Francis in 2019, exposed the personal data of over 700,000 users before being fixed earlier this year. The app, developed by La Machi Communication for Good Causes for the Pope’s Worldwide Prayer Network, offers daily prayers and a digital prayer community.
Independent researcher BobDaHacker discovered two critical flaws in the app’s API in January 2026. The first was an Insecure Direct Object Reference (IDOR) vulnerability, where the API returned user records including email addresses, full names, countries, and dates of birth to anyone who requested them, without proper authorization checks. The app assigned sequential numeric IDs to users, allowing attackers to cycle through all 719,517 registered accounts.
A second flaw compounded the risk: the API exposed validation hashes in email verification responses, enabling attackers to hijack accounts by registering with an email they didn’t own and verifying it before the legitimate user could.
Despite reporting the issue to nine different email addresses associated with the app and the Vatican, the researcher received no response. The flaws were only addressed after a journalist intervened, highlighting gaps in the Vatican’s vulnerability disclosure process.
This isn’t the first security lapse involving a Vatican-affiliated app. In 2019, a flaw in the eRosary app exposed login PINs in plaintext, allowing account takeovers a similar issue to the one found in Click To Pray.
While Vatican City introduced its own data protection regulation (Decree No. DCLVII) in April 2024, it remains unclear whether it applies to the app or its operators. The exposed data, which may have been circulating for months, increases the risk of phishing attacks, particularly since the app’s emails failed standard authentication checks, making impersonation easier.
Pope's Worldwide Prayer Network cybersecurity rating report: https://www.rankiteo.com/company/popesprayer
"id": "POP1785241904",
"linkid": "popesprayer",
"type": "Vulnerability",
"date": "1/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '719,517',
'industry': 'Non-Profit/Religious',
'location': 'Vatican City',
'name': 'Pope’s Worldwide Prayer Network',
'type': 'Religious Organization'},
{'customers_affected': '719,517',
'industry': 'Technology/Software',
'name': 'La Machi Communication for Good Causes',
'type': 'App Developer'}],
'attack_vector': 'API Vulnerability',
'data_breach': {'number_of_records_exposed': '719,517',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'Personally Identifiable Information '
'(PII)',
'type_of_data_compromised': ['Email addresses',
'Full names',
'Countries',
'Dates of birth']},
'date_detected': '2026-01',
'description': 'A security vulnerability in *Click To Pray*, a prayer app '
'launched by Pope Francis in 2019, exposed the personal data '
'of over 700,000 users before being fixed earlier this year. '
'The app, developed by *La Machi Communication for Good '
'Causes* for the *Pope’s Worldwide Prayer Network*, offers '
'daily prayers and a digital prayer community. Independent '
'researcher *BobDaHacker* discovered two critical flaws in the '
'app’s API in January 2026, leading to unauthorized access to '
'user data.',
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': 'Personal data (email addresses, full names, '
'countries, dates of birth)',
'identity_theft_risk': 'Increased risk of phishing attacks',
'systems_affected': 'Click To Pray app API'},
'investigation_status': 'Resolved (after journalist intervention)',
'lessons_learned': 'Gaps in vulnerability disclosure process; need for '
'improved API security and email authentication.',
'post_incident_analysis': {'corrective_actions': ['API flaws fixed',
'Improved vulnerability '
'disclosure process'],
'root_causes': ['Insecure Direct Object Reference '
'(IDOR)',
'Exposed validation hashes in '
'API']},
'recommendations': ['Implement proper authorization checks for API endpoints',
'Secure validation hashes',
'Improve vulnerability disclosure channels',
'Enhance email authentication to prevent impersonation'],
'references': [{'source': 'Independent researcher (BobDaHacker)'}],
'regulatory_compliance': {'regulations_violated': 'Potential violation of '
'Vatican’s *Decree No. '
'DCLVII* (2024)'},
'response': {'containment_measures': 'API flaws fixed after journalist '
'intervention'},
'title': 'Vatican’s Click To Pray App Exposed User Data Due to API Flaws',
'type': 'Data Breach',
'vulnerability_exploited': ['Insecure Direct Object Reference (IDOR)',
'Exposed Validation Hashes']}