Vatican’s Click To Pray App Exposed 700,000 Users’ Data Due to Basic API Flaw
In a stark example of avoidable security failures, the Vatican’s Click To Pray app personally endorsed by Pope Francis in 2019 leaked the personal data of over 700,000 users for months due to an elementary API vulnerability. The flaw, discovered by white-hat hacker BobDaHacker in January 2026, was only patched on July 24, 2026, after seven months of unanswered disclosure attempts.
The issue stemmed from a sequential user ID system in the app’s backend API. By simply incrementing a numeric ID in the endpoint https://api.clicktopray.org/user/users/[ID], anyone could access full user profiles including names, email addresses, dates of birth, countries, and account roles without authentication. The server, running on the basic Express Node.js framework, lacked rate limiting, allowing automated scraping of the entire dataset.
Despite multiple emails to Vatican and app contacts, the vulnerability remained unaddressed until BobDaHacker went public. The fix, implemented silently after the disclosure, now restricts access to a user’s own data while exposing only public-facing details for others. Notably, legitimate app emails had also triggered phishing warnings in mail clients, further eroding user trust.
The exposed data posed significant risks, particularly for the app’s predominantly older, less tech-savvy user base. With verified names, emails, and ties to a high-trust religious institution, attackers could craft highly convincing phishing campaigns. The incident underscores how even basic oversights like a missing authentication check can lead to large-scale breaches, especially when compounded by delayed responses from institutions.
The Click To Pray app remains available, with user data now secured behind the authorization controls that should have been in place from the start. The case serves as a reminder of the consequences when foundational security practices are overlooked.
Source: https://games.gg/news/vatican-click-to-pray-app-security/
The Vatican cybersecurity rating report: https://www.rankiteo.com/company/vatican
"id": "VAT1785184303",
"linkid": "vatican",
"type": "Breach",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '700,000',
'industry': 'Religious/Non-Profit',
'location': 'Vatican City',
'name': 'Click To Pray (Vatican)',
'type': 'Mobile Application'}],
'attack_vector': 'API Misconfiguration',
'data_breach': {'data_exfiltration': 'Possible via automated scraping',
'number_of_records_exposed': '700,000',
'personally_identifiable_information': 'Names, email '
'addresses, dates of '
'birth, countries, '
'account roles',
'sensitivity_of_data': 'High (names, emails, dates of birth, '
'countries, account roles)',
'type_of_data_compromised': 'Personally Identifiable '
'Information (PII)'},
'date_detected': '2026-01-01',
'date_publicly_disclosed': '2026-07-24',
'date_resolved': '2026-07-24',
'description': 'The Vatican’s *Click To Pray* app, personally endorsed by '
'Pope Francis in 2019, leaked the personal data of over '
'700,000 users for months due to an elementary API '
'vulnerability. The flaw allowed unauthorized access to user '
'profiles via sequential user IDs in the app’s backend API, '
'exposing names, email addresses, dates of birth, countries, '
'and account roles. The vulnerability was discovered by '
'white-hat hacker *BobDaHacker* in January 2026 and patched on '
'July 24, 2026, after seven months of unaddressed disclosure '
'attempts.',
'impact': {'brand_reputation_impact': 'Erosion of user trust, phishing '
'warnings in mail clients',
'data_compromised': 'Names, email addresses, dates of birth, '
'countries, account roles',
'identity_theft_risk': 'High (due to exposed PII)',
'operational_impact': 'Loss of user trust, potential phishing '
'risks',
'systems_affected': 'Click To Pray app backend API'},
'investigation_status': 'Resolved',
'lessons_learned': 'Basic security oversights (e.g., missing authentication) '
'can lead to large-scale breaches, especially when '
'compounded by delayed responses from institutions. '
'Foundational security practices (e.g., rate limiting, '
'proper API authentication) are critical for all '
'applications, regardless of their perceived sensitivity.',
'motivation': 'Ethical disclosure',
'post_incident_analysis': {'corrective_actions': 'Implemented authentication '
'controls for API access, '
'restricted data exposure to '
'public-facing details only',
'root_causes': 'Lack of '
'authentication/authorization '
'controls in API, sequential user '
'ID system, no rate limiting, '
'delayed response to vulnerability '
'disclosure'},
'recommendations': 'Implement authentication and authorization controls for '
'all APIs, enforce rate limiting, conduct regular security '
'audits, and establish a clear vulnerability disclosure '
'process with timely responses.',
'references': [{'source': 'White-hat hacker disclosure (BobDaHacker)'}],
'response': {'communication_strategy': 'Silent patch after public disclosure',
'containment_measures': 'Restricted API access to user’s own '
'data, exposed only public-facing '
'details for others',
'remediation_measures': 'Implemented authentication controls for '
'API access'},
'threat_actor': 'BobDaHacker (white-hat hacker)',
'title': 'Vatican’s Click To Pray App Exposed 700,000 Users’ Data Due to '
'Basic API Flaw',
'type': 'Data Breach',
'vulnerability_exploited': 'Sequential user ID system with no authentication '
'or rate limiting'}