A Vatican-linked prayer app, Click To Pray, exposed personal information belonging to more than 700,000 users through a serious API security flaw.
The app was developed for the Pope’s Worldwide Prayer Network and promoted as a digital prayer community. According to Malwarebytes, it was launched by Pope Francis in 2019 and allowed users to participate in daily prayers and share intentions through the platform.
The exposed data reportedly included email addresses, first and last names, countries, and dates of birth.
What Happened
Independent security researcher BobDaHacker discovered the issue in January 2026. The flaw affected an API endpoint used by the Click To Pray app. Instead of returning data only for the authenticated user, the API allowed anyone to request records belonging to other users by changing the user ID.
The user IDs were sequential, which made the exposure worse. According to the researcher’s findings cited by Malwarebytes, the app had 719,517 registered IDs, meaning more than 700,000 user records were potentially accessible.
This type of vulnerability is known as an Insecure Direct Object Reference, or IDOR.
In simple terms, the server trusted the user-supplied ID too much and failed to check whether the requester was authorized to view that record.
Why IDOR Bugs Are Dangerous
IDOR vulnerabilities are simple but often very damaging.
The attacker does not need malware, phishing, or advanced exploitation. If the API exposes predictable identifiers and fails to verify authorization properly, an attacker can request one record after another.
In this case, the combination of sequential user IDs and missing authorization checks meant that the app could expose user data at scale. Tom’s Hardware reported that there was also no rate limiting, making automated collection easier.
That makes the issue more than a single-user privacy bug.
It becomes a mass data exposure risk.
What Data Was Exposed
The exposed information reportedly included:
- email address
- first and last name
- country
- date of birth
This may not sound as severe as passwords or payment-card data, but it is still valuable to attackers.
A list of real users of a Vatican-linked prayer app can be highly useful for phishing, fraud, and social engineering. Attackers could craft messages that appear to come from religious, charitable, Vatican-affiliated, or prayer-related services.
That trust context makes the dataset more sensitive than a generic email list.
A Second Verification Weakness
The API exposure was not the only issue.
Malwarebytes also reported that the app returned a validation hash used during email verification. That could allow an attacker to register an account using an email address they did not control and verify it by inspecting the API response, rather than opening the real mailbox.
This is another example of sensitive backend logic leaking through client-facing responses.
Verification tokens should never be exposed to users or attackers through API output.
Disclosure Problems
According to Malwarebytes, BobDaHacker first reported the bug on January 3, 2026, sending emails to nine different contacts, including Click To Pray, the Pope’s Worldwide Prayer Network, and a general information address. The report says the issue remained unresolved for more than six months and was fixed only after the researcher contacted a journalist, who then contacted the Vatican.
That timeline highlights a common problem in vulnerability disclosure.
A bug report is only useful if the organization has a working process to receive it, triage it, acknowledge it, and fix it.
Without that process, even simple but serious vulnerabilities can remain exposed for months.
Why This Matters
The Click To Pray incident shows that privacy risk is not limited to banks, hospitals, or major social networks.
Any app that collects personal data becomes responsible for protecting it.
Religious and community apps may hold especially sensitive context because they reveal something about a person’s beliefs, habits, identity, or trusted communities.
Even when the leaked fields are basic, the context around them can make the exposure more dangerous.
A phishing email referencing a user’s prayer app account, faith community, or Vatican-linked service may be more convincing than a generic scam.
What Users Should Do
Anyone who used Click To Pray should assume their name, email address, country, and date of birth may have been exposed.
Users should be cautious of:
- emails claiming to come from Click To Pray
- fake Vatican or religious charity messages
- donation requests
- account verification emails
- prayer-community login prompts
- messages asking for passwords or payment details
- links to unofficial login pages
Users should avoid clicking links in unexpected messages and should go directly to official websites or apps instead.
If the same password was reused on other services, it should be changed immediately.
What App Developers Should Learn
This incident is a textbook reminder of API security basics.
Developers should ensure that:
- every API request checks authorization
- users can only access their own records unless explicitly permitted
- sequential IDs are not treated as access control
- sensitive tokens are never returned in API responses
- rate limiting is applied to user-data endpoints
- security reports have a clear intake process
- logs are reviewed for mass enumeration attempts
- privacy-sensitive applications receive regular security testing
The most important lesson is simple: authentication proves who the user is, but authorization decides what that user is allowed to access.
Both are required.
Final Thoughts
The Click To Pray exposure was caused by a simple but serious authorization failure.
A predictable user ID and an API that did not properly verify access were enough to expose personal data from more than 700,000 users.
The case also shows why vulnerability disclosure processes matter. A flaw discovered in January reportedly remained unresolved for months, despite repeated contact attempts.
Never trust client-supplied identifiers, never expose verification tokens, and never assume that a “small” app is too niche to become a valuable target.
