# Pope's official prayer app leaks data of 700K+ users Security flaw left vulnerable for months, exposing sensitive information. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-07-24 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/5630dc7f-5782-406f-b564-f95b5601a92a ## Major security flaw in Pope-endorsed app The Click To Pray app, endorsed by the Pope, failed to protect the personal data of over 700,000 users. Names, emails, and birthdates were exposed. Ethical hacker BobDaHacker reported the issue in January, but it remains unresolved, leaving user data at risk. ## How the IDOR vulnerability works The app's API had an Insecure Direct Object Reference (IDOR) flaw, allowing anyone to access user data by simply entering an ID number. With no authorization checks, a simple loop could scrape all user data. The lack of basic security measures poses a significant threat. ## Who is affected? Many users are elderly and less tech-savvy, making them prime targets for phishing. Their trust in Vatican-related platforms increases their vulnerability. Attackers could easily exploit the leaked data to craft convincing scams, putting users at serious risk. ## A phishing goldmine The leaked email addresses are a treasure trove for attackers. Fake emails with subject lines like 'Urgent message from the Pope' could easily trick users. Ironically, the app's real verification emails already look suspicious, making it harder to distinguish legitimate messages. ## Faulty verification system The app's sign-up process returns the verification link's UUID directly in the response, allowing attackers to register with any email and verify it instantly. Additionally, the real verification emails fail domain authentication, further eroding trust in the platform's security. ## What this negligence reveals This incident highlights how even religious institutions can neglect digital security. Protecting user data should be a top priority, yet such oversights create massive risks. The app's continued silence on the issue only deepens concerns about accountability and user safety. ## Sources covering this story - https://www.theregister.com/security/2026/07/24/popes-official-prayer-app-commits-cardinal-sin-leaks-700k-users-info/5278603 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._