www.it-connect.fr
Click to Pray Exposed Data for More Than 700,000 Users
A simple GET request in a browser was enough to retrieve the name, email address, country, and date of birth of any of the 719,517 Click to Pray accounts, the Pope's official prayer app. Reported on January 3, 2026, the flaw remained open for nearly seven months. It was only patched on July 24, 2026. Let's take a closer look at this security issue.
Click to Pray is the official app of the Pope's Worldwide Prayer Network. That's quite a statement. Launched by Pope Francis in 2019, the app is available on iOS, Android, and on the web at clicktopray.org, in seven languages. However, he did not develop the app himself... But the app does belong to the Vatican.
Table of Contents
A classic IDOR, and 719,517 user records left exposed
BobDaHacker is the pseudonym of the person who identified this security flaw, and it comes down to a single line. The endpoint GET https://api.clicktopray.org/user/users/{id} returned the full profile of any account based on its identifier, with no authorization check or ownership verification whatsoever. No authentication required. Nada.
For each request, the API returned the following content:
- First and last name
- Email address
- Country of origin, as a numeric value
- Date of birth, stored in a field named
borned_date - Account role, which made it possible to distinguish a regular user (role
PRAYER, meaning prayer in French) from an administrator account - Account status
Beyond the vulnerability itself, there are two more issues here: user IDs are sequential, and there is no rate limiting. In other words, it is possible to hammer the API with a loop and scrape the entire account database. Unsurprisingly, the first entries in the list belong to staff from the Worldwide Prayer Network.
The security flaw in question is an IDOR, which is a broken access control issue. As a reminder, this is the same type of flaw that caused the ANTS data leak. Broken Access Control has held the top spot in the OWASP Top 10 since 2021, and it retains that position in the 2025 edition of the ranking.
An email verification bypass
Beyond the IDOR flaw that allowed the entire user database to be retrieved via the API, BobDaHacker identified a second security issue, also on the API. According to him, the endpoint used to create an account (POST /user/users/sign-up) returned the account's validation_hash directly in the response body. The problem is that this is the same unique identifier contained in the verification link sent by email. So, in effect, the app allows an account to be created with any email address and validated immediately, without ever accessing the inbox.
That makes it possible to create large numbers of accounts with fake email addresses. On top of that, there is a poor SPF, DKIM and DMARC configuration, which is rather problematic if the account database had fallen into the wrong hands.
Six months of silence, then a patch
On January 3, 2026, BobDaHacker wrote to nine recipients: the general contact address, six clicktopray.org staff members, and two contacts from the Worldwide Prayer Network.
No response. No security.txt file, no disclosure policy, no bug bounty program. A good opportunity to revisit our article on how to make vulnerability reporting easier.
Six months later, in July 2026, the case was handed over to Nate Nelson, a journalist at Dark Reading. The publication then contacted the Worldwide Prayer Network press office as well. Silence there too. During all that time, the accounts remained exposed (and they had probably been exposed for quite some time already).
The article was published on July 24, 2026, and the endpoint was changed shortly afterward, without any notification to the person who had reported the issue. They reportedly learned about it through a Reddit comment before verifying it themselves. The fix is now in place: the endpoint now returns only the first and last name for a third-party account, and the email address only for the user's own account.
Finally, note the irony pointed out by Dark Reading: on April 30, 2024, the Vatican adopted its own personal data protection rules, Decree No. DCLVII, which requires “appropriate security measures” and designates the people responsible for implementing them. Clearly, those provisions did not make it into the application layer.
To go further on this topic:
