Vatican's Official 'Click to Pray' App Has Leaked 700,000 Users' Data for Six Months Despite Warnings

The Vatican's official prayer app has been quietly exposing the personal data of more than 700,000 users worldwide for at least six months, according to a security researcher who says repeated attempts to warn the app's operators went unanswered.

A widely used app with a basic security flaw

"Click to Pray" is the official prayer app of the Pope's Worldwide Prayer Network, offering daily prayers and papal content to users through iOS, Android and a web browser. According to the app's own website, it is used in nearly every country in the world. In January, a security researcher who goes by the handle "BobDaHacker" discovered a flaw known as an insecure direct object reference, or IDOR, in the app's underlying code at clicktopray.org.

The vulnerability allowed any internet user, without any special technical skill, to query a single exposed application programming interface endpoint and retrieve basic personal information belonging to every account holder on the platform, as well as staff accounts belonging to employees of the Pope's Worldwide Prayer Network itself. Cybersecurity outlet Dark Reading independently tested and confirmed the vulnerability remained live as of its reporting.

How the flaw worked

When users sign up for Click to Pray, they provide a first and last name, an email address, a password and an optional country field. Behind the scenes, each new account is assigned a sequential numerical user ID. Because the app's API endpoint failed to verify whether a request was authorized before returning data, anyone who supplied a valid user ID, in sequence, could retrieve that account's name, email address and country of origin in plain text, along with information on whether an account had been deleted or carried administrative privileges. Researchers say the flaw would have allowed someone to systematically collect data from all of the platform's more than 719,000 registered accounts.

BobDaHacker described the underlying issue as one of the most common categories of web application vulnerabilities. "IDORs are incredibly common. Broken Access Control has been the number one vulnerability category in the OWASP Top 10 since 2021," the researcher said, referring to the industry-standard list of the most critical web application security risks maintained by the Open Worldwide Application Security Project. The researcher attributed the recurring nature of such flaws to a common gap in how web development frameworks handle security: most frameworks automatically verify whether a user is logged in, but leave it up to individual developers to separately verify whether that user is authorized to view a specific piece of data, a step that is easy to overlook under time pressure.

Months of silence from Vatican-linked officials

According to the researcher's own account, the vulnerability was first reported to nine email addresses associated with Click to Pray and the Pope's Worldwide Prayer Network on Jan. 3, but none of those messages received a response. Dark Reading said it separately reached out to the Pope's Worldwide Prayer Network in an attempt to help get the issue fixed, and, after failing to get a response, contacted La Machi Communication for Good Causes, the Spanish-language communications agency that designed and built the app, but had not received a reply as of publication.

Reflecting on the lack of response after months of waiting, the researcher wrote in a blog post documenting the findings, "I guess my email wasn't in their prayers."

Not the app's first security lapse

This isn't the first time Click to Pray has faced scrutiny over its handling of user data. In 2019, cybersecurity firm Fidus Information Security discovered that the app's companion Bluetooth-connected eRosary device, priced at roughly $110, was returning users' login PINs in plain text through its API, a flaw the firm reportedly identified within about 10 minutes of testing. A Vatican spokesperson confirmed at the time that the earlier flaw had been fixed. The latest disclosure suggests that lessons from that earlier episode may not have carried over fully into the app's current infrastructure.

Why the exposed data matters

While the leaked information, primarily names, email addresses and country data, may seem limited compared to breaches involving financial or medical records, researchers warned it still carries real risk. BobDaHacker noted that Click to Pray's user base likely skews toward older, less tech-savvy users who tend to place significant trust in anything associated with the Vatican, making the exposed accounts a potentially attractive target for phishing campaigns. A scammer with access to the leaked email addresses could impersonate the Pope's Worldwide Prayer Network directly, sending messages designed to appear as official Vatican communications in order to trick recipients into clicking malicious links or revealing further personal information.

A broader pattern across industries

Security researchers say the Click to Pray incident reflects a pattern seen across organizations of all sizes and sectors, not just religious institutions or smaller communications firms. BobDaHacker emphasized that any organization collecting personal data from hundreds of thousands of users takes on a responsibility to protect it, regardless of its mission or size. Notably, the Vatican issued its own formal personal data protection regulation, Decree No. DCLVII, in April 2024, which outlines requirements for security measures, risk analysis and incident reporting procedures. The existence of that decree has done little to prevent the current exposure, underscoring the gap that can exist between written policy and actual technical implementation.

As of this report, the vulnerability remained active, and neither the Pope's Worldwide Prayer Network nor La Machi Communication for Good Causes had issued a public response addressing the flaw or confirming a timeline for a fix. Security researchers tracking the disclosure say the case illustrates a broader industry challenge: making basic cybersecurity practices, including having a clear channel for reporting vulnerabilities, as standard and expected for organizations of every kind as having a functioning contact page. Until Click to Pray's operators address the underlying authorization flaw, cybersecurity researchers say the personal information of hundreds of thousands of users worldwide remains freely accessible to anyone who knows where to look.