The official prayer app endorsed by the Pope has been leaking personal information of more than 700,000 users worldwide for at least six months, according to a security researcher who reported the vulnerability in January 2026 with no response from the organization. Click To Pray, which connects Catholics globally through the Pope’s Worldwide Prayer Network, exposed users’ names and email addresses through a simple exploit that required no sophisticated hacking skills.
Security researcher BobDaHacker discovered the prayer app data leak and disclosed it to the Pope’s Worldwide Prayer Network on January 3, 2026. As of July 24, 2026, the vulnerability remained active and unpatched, affecting all 719,517 registered accounts across the app’s iOS, Android, and web versions available in seven languages.
How Did the Prayer App Leak User Data?
The security flaw stems from an Insecure Direct Object Reference (IDOR) vulnerability in Click To Pray’s API. When users register for an account, the app assigns sequential five-digit numeric user IDs. The API endpoint accepts requests for user data without verifying whether the requester is authorized to access that information. By simply changing the user ID number in the API request, anyone could retrieve another user’s personal details including email address, first and last name, country, date of birth, and account deletion status.
According to BobDaHacker’s analysis, the exploit required minimal technical knowledge. With sequential user IDs and no rate limiting implemented, an attacker could enumerate every single account on the platform with one simple GET request per user. The researcher noted this makes the exposed database a significant phishing risk, particularly given the likely demographics of Vatican app users.
What Makes This Breach Particularly Dangerous?
The security researcher highlighted that many Click To Pray users are likely older individuals who place high trust in Vatican-related communications, making them prime targets for phishing attacks. An email appearing to come from the Holy Father or Vatican officials could easily deceive users into clicking malicious links.
The vulnerability extended beyond the basic data leak. The app’s signup endpoint returned an account validation hash directly in the response body, using the same UUID sent in email verification links. This meant attackers could register accounts using any email address and verify them before the legitimate account holder received the confirmation message.
Adding to the security concerns, BobDaHacker reported that legitimate verification emails from Click To Pray failed domain authentication requirements and appeared similar to phishing attempts. This means fraudulent emails would carry the same level of authentication as genuine communications from the prayer network.
Has the Vatican Responded to the Security Disclosure?
Despite the initial disclosure on January 3, 2026, the Pope’s Worldwide Prayer Network provided no response to BobDaHacker’s security report. The Register also reached out to the organization and received no reply. As of the researcher’s July 24 blog post, the vulnerability remained actively exploitable, with all 719,517 user accounts still exposed.
Source: The Register