Vatican's Click To Pray App Exposes 700K+ Users' PII via Insecure API

A critical security flaw in the Vatican's official prayer application has exposed the personal information of more than 700,000 users worldwide, raising serious concerns about data protection practices within one of the world's most influential religious institutions. The exposed data includes full names, email addresses, country of origin, and account status — a goldmine for cybercriminals running phishing and credential-stuffing campaigns. Researchers discovered that the application's API endpoint lacked proper authentication controls, allowing any user with a web browser to enumerate and harvest user records without needing elevated privileges or specialized tooling.

The vulnerability is particularly concerning given the app's user base, which is believed to include clergy, Vatican employees, diplomats, and devout laypeople across more than 150 countries. An attacker exploiting this flaw could easily compile a targeted list of high-profile individuals within the Catholic Church — including those holding sensitive ecclesiastical or diplomatic positions — and tailor social engineering attacks accordingly. Security analysts noted that the leaked email addresses alone present immediate risk, as they can be cross-referenced against known data breaches to identify reused passwords and launch credential-based attacks against other Vatican digital services.

This incident underscores how even organizations handling spiritually significant — rather than purely commercial — workloads are not immune to fundamental application security failures. The exposed endpoint reportedly returned structured JSON responses containing user records in response to simple sequential or predictable ID requests, a textbook example of an Insecure Direct Object Reference (IDOR) vulnerability combined with broken access control. For organizations building public-facing applications, this serves as a stark reminder that every API endpoint must enforce authentication and authorization checks by default, not as an afterthought. Users of the affected app should immediately check whether their credentials have appeared in other known incidents using an email breach checker and update any reused passwords.

Beyond password rotation, affected individuals should review their overall digital exposure in light of this leak. Conducting a thorough privacy checkup can help users identify other vectors — such as exposed DNS queries or browser fingerprinting risks — that may compound the threat from this disclosure. The Vatican has reportedly been notified of the flaw, and remediation efforts are understood to be underway. As religious institutions continue to digitize their outreach and operations, this breach highlights the urgent need for standardized security audits, responsible disclosure programs, and adherence to data protection frameworks like GDPR — regardless of an organization's faith-based or non-commercial mission.