An official Vatican prayer app promoted by Pope Francis exposed the personal details of more than 700,000 users until a security fix was applied in July 2026. The flaw in Click To Pray allowed anyone to request other accounts by changing a number in the app’s API.
The issue came to light in a July 24 investigation by white-hat hacker BobDaHacker. The researcher said the app returned user names, email addresses, countries, dates of birth, roles, and deletion status without checking whether the requester had permission to view the account.
The problem centered on predictable account IDs. Click To Pray assigned users numbers in sequence, then exposed account data through:
https://api.clicktopray.org/user/users/[ID number goes here]
That endpoint did not require an ownership check, and the service also lacked rate limiting. In practice, an attacker could have automated requests across the account range and collected a large amount of personal information quickly.
“No authorization check. No ownership validation. Just increment the number and get someone else’s data. The Lord provides,” BobDaHacker wrote in the investigation. The response also identified X-Powered-By: Express, leading to the researcher’s sharp description of the Vatican’s “prayer infrastructure” as being built on “the framework you learn in week two of a Node.js bootcamp.”
The exposure created a clear phishing risk. Click To Pray users may be older or less familiar with online scams, and the leaked information could help an attacker craft messages that appear to come from the Vatican. BobDaHacker also reported that legitimate emails from the service triggered warnings about failing domain authentication, which made genuine messages look suspicious in the first place.
The API now limits account access
BobDaHacker said the flaw was discovered in early January 2026, followed by emails to nine Vatican and Click To Pray contacts on January 3. The researcher said none of those contacts responded at the time. The Register also reported on the exposed data and the delayed response.
After the investigation reached journalists and the blog post went public, the endpoint began behaving differently. Requests for a user’s own ID still returned that account’s email address, while requests for another person’s ID returned only a public profile rather than private details. BobDaHacker also said a test email from the app no longer triggered the earlier authentication warning.
The original promotion dates back to January 20, 2019, when Pope Francis invited people in St. Peter’s Square to use Click To Pray. Hundreds of thousands of people joined over the following years, turning the API flaw into a much larger privacy problem than a routine app bug.
Click To Pray’s exposed data is no longer being returned through the vulnerable request pattern, but the episode shows how damaging a basic access-control error can become when it affects a trusted institution and a large user base. Share your thoughts in the comments, and follow us on X, Bluesky, YouTube, Instagram.
