A massive security vulnerability in the Vatican's 'Click to Pray' app has exposed the names and email addresses of over 700,000 users worldwide. The flaw allows anyone with a browser to access sensitive personal information via an unprotected API.

Key Takeaways

  • A critical IDOR vulnerability was discovered in the Vatican's 'Click to Pray' platform.
  • Over 700,000 user records, including names and emails, are publicly accessible.
  • The flaw allows unauthorized access to both regular users and administrative staff.
  • The vulnerability remains unpatched despite reports to the developers.

The Vatican's official prayer application, 'Click to Pray', has fallen victim to a significant data exposure. Designed to connect believers globally with daily prayers and papal content, the app's digital infrastructure has failed to protect the very people it serves. A porous API endpoint has left the personally identifiable information (PII) of hundreds of thousands of users vulnerable to anyone with a web browser.

The Anatomy of the Leak

The breach was identified by white-hat hacker 'BobDaHacker', who discovered an Insecure Direct Object Reference (IDOR) vulnerability on clicktopray.org. This type of flaw allows an attacker to bypass authorization checks by simply querying sequential user IDs. By entering a specific URL, an attacker can enumerate through the database, harvesting names, email addresses, and country locations in plaintext.

Why This Matters

BozokMedia analysis shows that this is not just a technical glitch, but a massive social engineering risk. Because the leaked data is tied to a religious context, attackers could easily impersonate the Pope's Worldwide Prayer Network to launch highly convincing phishing campaigns. Leveraging a user's faith to gain trust makes these potential scams significantly more dangerous than standard corporate data breaches.

'IDORs are incredibly common because most frameworks handle authentication but fail to implement proper authorization for specific resources.'

The vulnerability is remarkably easy to exploit, requiring no advanced hacking tools—only a standard browser. Dark Reading's independent testing confirmed that the data remains exposed, including the details of administrative staff and employees of the organization.

Historical Background

Broken Access Control, which includes IDOR vulnerabilities, has consistently ranked as the number one security risk in the OWASP Top 10 since 2021. This highlights a recurring theme in software development: as organizations rush to deploy features, fundamental security checks regarding 'who is allowed to see what' are often overlooked.

Did You Know?: Users who utilized Apple's 'Hide My Email' feature during registration remained largely protected from this specific leak.

Frequently Asked Questions

1. What specific data was leaked?
The leak includes full names, email addresses, and the country of origin for over 700,000 accounts.

2. Is the app still safe to use?
Until a formal patch is confirmed by the developers (La Machi), users should be extremely cautious of any unsolicited emails claiming to be from the Vatican.