Vatican's Official Prayer App Leaks 700K+ Global Users' PII

A porous API endpoint exposes, names, email addresses, country, and site status, all of which can be easily gleaned by anyone with a browser.

A popular Vatican website and mobile app has been leaking hundreds of thousands of users' names and email addresses.

In January, the white hat hacker "BobDaHacker" discovered an insecure direct object reference (IDOR) vulnerability in clicktopray.org. Any passing Internet user could query a specific, totally exposed application programming interface (API) endpoint to see basic personally identifying information (PII) belonging to all of Click to Pray's account holders, as well as active employees of the organization that runs the app, the Pope's Worldwide Prayer Network.

Dark Reading independently tested and confirmed the vulnerability. It contacted the Pope's Worldwide Prayer Network, to try to help the independent hacker get the issue fixed. Having failed at that, it then reached out to La Machi — the communications company that designed and developed the app — for on this story, but hasn't received a response yet.

Unfortunately, the website exposes an API endpoint that then leaks your information to anybody, no authorization required. If an attacker discovers the endpoint, and supplies any user ID, they can enumerate any number of the site's users, plus administrative and staff accounts.

Dark Reading confirmed that the issue remains live as of the time of publication. It requires no technical skill to exploit, only a single domain entered into a browser's address bar. More than 700,000 user accounts are freely available, and the lowest-numbered user IDs are associated with Click to Pray staff. Email addresses and names are leaked in plaintext, and countries of origin are assigned numerical values. Each listing also indicates whether the associated account has been deleted, and whether it possesses administrative privileges (those without are assigned the role "PRAYER").

Any attacker who wants to scrape all this data could do so using a simple script. At that point, it would be trivial to mass email all the site's users, impersonating the Pope's Worldwide Prayer Network, or otherwise leveraging victims' faith to socially engineer them.

BobDaHacker acknowledges that the Pope isn't the first fella to have this problem.

" IDORs are incredibly common. Broken Access Control has been the number one vulnerability category in the OWASP Top 10 since 2021, and IDOR is probably the single most common flavor of it. I find them constantly. Across every industry, every tech stack, every size of company," they say.

The reason developers keep falling into this same trap, they explain, "is that most frameworks handle authentication for you but don't handle authorization. Your framework will check 'Is this person logged in?' but it won't check 'Should this person be allowed to see this specific resource?' That second check is on the developer to implement, and it's really easy to forget when you're moving fast and building features."

Users can protect themselves from the worst consequences of using insecure apps by anonymizing the information they provide during the account registration process. For example, Dark Reading observed that many Click to Pray users provided abbreviated names or alphanumeric handles when signing up for their accounts. Many also appear to have signed up using Apple devices, and took advantage of Apple's "Hide my Email" feature, which supplies the website with a gibberish relay email address instead of the real one it forwards to. As a result, those users' email addresses and even their names are inaccessible to hackers, despite the site's leaky endpoint.

Click to Pray was designed and developed by La Machi Communication for Good Causes, a midsized Spanish-language communications agency. It is the property of the Pope's Worldwide Prayer Network, a global foundation of the Vatican.

Religious institutions and boutique communications companies aren't typically the most cybersecurity-forward kinds of organizations. Basic cybersecurity vulnerabilities might come with the territory. "Organizations handling hundreds of thousands of users' personal data have a responsibility to protect it regardless of whether they're a tech company or a church," says BobDaHacker. "If you're collecting emails, names, and dates of birth from 700,000 people, you're a data custodian, whether you like it or not. Your mission statement doesn't change that."

Ironically, the Vatican did issue its own personal data protection regulation on April 30, 2024, as Decree No. DCLVII. Translating from the original text in Italian, Dark Reading found ample stipulations that reference the need to establish "appropriate security measures to achieve the objectives of protecting personal data," risk analyses, "individuals authorized to implement security measures," a process for reporting issues to security leaders, and more.

Evidently, the self-imposed regulations haven't done the trick so far. What, then, can drag immature organizations over the line, to attain an acceptable baseline of cybersecurity?

"I think the answer is making security basics so accessible and so normalized that not having a security is as weird as not having a page," BobDaHacker says. "We're not there yet. But every time a story like this comes out, it moves the needle a little."

Nate Nelson is a journalist and award-winning scriptwriter. In addition to Dark Reading he writes for Darknet Diaries, the most popular show in cybersecurity across all media.

He began his career as a freelancer, ghostwriting Forbes and CNBC op-eds for executives in tech and finance. Then he transitioned to journalism at Threatpost, where he covered cybersecurity news and trends. Throughout those years he co-created a cybersecurity podcast, Malicious Life, which in its day climbed into the Top 20 technology podcasts charts on Apple Podcasts and Spotify.

He holds degrees from New York University and Bard College. As a born and bred New Yorker, he enjoys a superiority complex, but is polite enough to keep it to himself.

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

Experts Explain How to Develop a Framework for Cyber-Fraud Fusion

Prevention at Machine Speed: Hunting Beyond Known Detections

0-Day to 10x Discovery: Security at the Speed of Mythos

When AI Becomes an Insider: Rethinking Risk in Critical Infrastructure

Governing the Agent; Identity Security in the Age of Autonomous AI