Pope's official prayer app leaks data of 700K+ users
Security flaw left unpatched for months, exposing sensitive data.
1Major security flaw in Pope-endorsed app
Click To Pray, the official prayer app of the Pope's Worldwide Prayer Network, leaked personal data of over 700,000 users. The app, available on iOS, Android, and web, was found to have a critical vulnerability. An ethical hacker discovered the issue six months ago, but no fixes were implemented.
2How the IDOR flaw works
The security flaw is an Insecure Direct Object Reference (IDOR) vulnerability. It allows users to access not only their own data but also that of other users. Sequential user IDs make it easy to retrieve any account's information without proper authorization checks.
3What data was exposed?
Exposed data includes users' email addresses, first and last names, countries, dates of birth, and account statuses. The API revealed all 719,517 accounts on the platform. This data could be exploited for phishing attacks and other malicious activities.
4Ethical hacker sounded the alarm
Ethical hacker BobDaHacker identified the vulnerability in January 2026 and reported it to the app's administrators. Despite six months passing, no corrective action was taken. The hacker confirmed the flaw remains active, leaving user data vulnerable.
5A phishing goldmine
The leaked data poses significant risks, especially for older and less tech-savvy users. These individuals might easily fall for phishing emails disguised as Vatican-related communications. The hacker warned, 'Your grandma would click that link every time.'
6Why security measures matter
This incident highlights the dangers of neglecting security measures in app development. Protecting user data is crucial, especially for apps with religious and sensitive content. The app's administrators must take immediate action to address the vulnerability.