Holy Data Leak! Pope's Prayer App Exposes 700,000 Users in Security Breach

The Vatican-backed Click To Pray app is at the centre of a cybersecurity controversy after ethical hacker BobDaHacker alleged that an API flaw exposed personal information from more than 700,000 user accounts. The researcher said the Pope-endorsed app leaked sensitive account details through an unsecured application programming interface (API). The vulnerability allegedly remained unresolved for months after it was reported.

The app, available in seven languages on iOS, Android, and the web, helps Catholics worldwide pray for the Holy Father's intentions. As of July 2026, it reportedly had 719,517 registered accounts.

A Simple Flaw With Massive Consequences

The issue stemmed from an Insecure Direct Object Reference (IDOR) vulnerability, a well-known security flaw that can expose data to unauthorised users. BobDaHacker said that the bug was uncovered on 3 January and was reported to the Pope's Worldwide Prayer Network, the organisation that runs the app.

'The vulnerability is still live,' the ethical hacker wrote in a blog post published Friday. 'Nobody has ever responded. I guess my email wasn't in their prayers.' The researcher said that every user gets a sequential numerical ID. By changing that number in an API request, anyone could allegedly access another person's account information. No sophisticated hacking techniques or special access was needed.

'There is no authorisation check or ownership validation,' BobDaHacker wrote. 'Just increment the number and get someone else's data.'

More Than Just Names and Emails

According to BobDaHacker, the exposed data included names, email addresses, countries, birth dates, account deletion status, and administrator privilege information. With sequential user IDs and no rate limiting on the API, an attacker could allegedly retrieve every registered account record through automated requests.

Experts say that IDOR vulnerabilities can be dangerous. Although modern development frameworks usually verify that a user is logged in, they don't automatically check whether a certain user is authorised to view a specific record. Developers should still ensure that users can access only their own data. Without safeguards in place, sensitive records can become publicly accessible.

A Potential Phishing Goldmine

The exposed user records could become a phishing goldmine, especially since many users are likely to trust messages that appear to come from the Vatican. BobDaHacker warned that older users could be particularly vulnerable.

The situation is even more alarming after the researcher reported a second issue in the app's registration process. The ethical hacker said that the signup endpoint returned the same validation hash used for email verification. As a result, this potentially allows someone to register using another person's email address and activate the account before the legitimate owner completed verification.

Adding to the concern, BobDaHacker claims that the app's legitimate verification emails failed standard email authentication checks during testing, causing them to appear suspicious. 'So not only is the API leaking 700,000 email addresses that could be used for phishing, but the real emails from Click To Pray already look like phishing,' the ethical hacker wrote. 'An attacker wouldn't even need to try hard.'

What Users Can Do

Although users can't fix server-side vulnerabilities, they can limit personal data linked to their personal accounts. Cybersecurity experts recommend using an anonymised display name and tools like Apple's Hide My Email to reduce the impact if account information is exposed by masking the user's real email address.

BobDaHacker said the vulnerability remained unpatched when it became public, roughly six months after it was first reported. At the time of writing, the Pope's Worldwide Prayer Network had not publicly responded. The incident is a reminder that even trusted institutions can fall victim to basic cybersecurity lapses and highlights the importance of strong authorisation controls.