A critical access control vulnerability in the Vatican’s official “Click to Pray” platform has exposed the personal data of more than 700,000 users, highlighting once again how basic web security misconfigurations continue to put large-scale user bases at risk.
The service, operated by the Pope’s Worldwide Prayer Network, is widely used across the globe to deliver daily prayers and papal content via web, iOS, and Android.
At the core of the issue is an insecure direct object reference (IDOR) vulnerability one of the most prevalent forms of broken access control.
By querying an exposed API endpoint, unauthenticated users could enumerate account records simply by iterating through sequential user IDs.
No authentication or authorization checks were enforced, effectively turning the application into an open directory of user data.
According to technical validation conducted by Dark Reading, the exposed endpoint allowed retrieval of personally identifiable information (PII), including full names, email addresses, and country identifiers in numeric format.
The dataset also revealed internal metadata such as account status (active or deleted) and privilege levels, distinguishing standard users from administrative or staff accounts.
Notably, lower user ID values were linked to organizational staff, increasing the potential risk of targeted attacks.
The original research published by BobDaHacker details how trivial exploitation was, requiring nothing more than a browser request to a predictable API structure.
This lack of complexity significantly lowers the barrier for abuse, enabling mass data harvesting through simple scripting techniques.
Despite responsible disclosure efforts, the vulnerability remained unpatched at the time of reporting.
Dark Reading Researchers said that, the vulnerability, discovered in January by independent researcher BobDaHacker, affects the Click to Pray web application (clicktopray.org) and its associated mobile platforms.
Attempts by Dark Reading to coordinate remediation through both the Pope’s Worldwide Prayer Network and development firm La Machi were unsuccessful, raising concerns about vulnerability response maturity within the ecosystem.
Vatican Prayer App Accounts
From an attack perspective, the implications are substantial. The exposed dataset could enable highly targeted phishing campaigns, particularly those exploiting religious trust and institutional authority.
Attackers could impersonate official Vatican communications and distribute malicious links or credential harvesting pages at scale.
Campaigns have been observed in past incidents involving leaked PII datasets, such as large-scale social engineering attacks leveraging compromised user directories.
The issue also underscores a broader industry problem. IDOR vulnerabilities fall under the OWASP Top 10 category of Broken Access Control, which has remained the most critical web application risk since 2021.
As noted in analysis from TechTarget, modern frameworks typically enforce authentication but often leave authorization logic to developers, creating gaps where sensitive resources are insufficiently protected.
In this case, the application correctly identified whether a user was logged in but failed to verify whether they were authorized to access specific records.
This distinction is subtle but critical, and its omission continues to drive widespread exposure incidents across sectors.
There are, however, signs that some users inadvertently mitigated their exposure. Dark Reading observed that individuals who used anonymized registration details such as Apple’s “Hide My Email” feature or pseudonymous identifiers effectively shielded their real identities despite the leak.
This aligns with broader privacy recommendations to minimize the use of real PII in non-essential applications.
The incident also connects to a wider pattern of API security failures, an area increasingly targeted by attackers due to the growing reliance on microservices and mobile backends.
Recent reporting, including coverage on endpoint security risks and ransomware exploitation of zero-day vulnerabilities, highlights how overlooked API protections can become entry points for larger campaigns.
What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist
