Pope’s official prayer app commits cardinal sin, leaks 700K+ users’ info
Click To Pray, the Pope-endorsed prayer app, reportedly exposed the personal information of more than 719,000 registered users through a basic security flaw that had allegedly been reported six months earlier without a response. The issue matters because the data could enable convincing phishing attempts aimed at users who may place particular trust in Vatican-branded communications.
A researcher said the app’s API allowed anyone to retrieve records for any valid sequential five-digit user ID without checking authorisation, exposing names, email addresses, countries, dates of birth and account-status information. The app reportedly had 719,517 accounts in July 2026, and the lack of rate limiting meant all could potentially be enumerated; a separate sign-up flaw also exposed email-verification tokens, potentially allowing accounts registered with another person’s email address to be verified.
In short
- Prayer app allegedly exposed data from 719,517 accounts.
- A simple API flaw reportedly allowed mass data scraping.
- Exposed details could support targeted Vatican-themed phishing.
Explained simply
Click To Pray is an official prayer application endorsed by the Pope and the Vatican. The app recently exposed the personal information of more than 719,000 registered users through a basic security flaw that had allegedly been reported six months earlier without being fixed.
The exposed data included names, email addresses, countries, and dates of birth. This matters because criminals could use such information to launch convincing phishing attacks against users who might trust communications appearing to come from Vatican-affiliated services, potentially compromising their security and damaging the app's credibility.
The flaw was remarkably simple: the system storing user information could be accessed by anyone who guessed the correct identification numbers, which were simply numbers in sequence. The app's registration system also had a separate weakness that could allow attackers to take control of accounts by exploiting verification codes.