Personal data of any user is exposed in Vatican's Click To Pray application

Click To Pray, the Vatican-endorsed prayer app run by the Pope's Worldwide Prayer Network, contained an Insecure Direct Object Reference (IDOR) flaw in its user API. The endpoint GET /user/users/{id} returned a user's personal data for any sequential numeric ID supplied, with no authorization check confirming the requester owned that account. This let anyone enumerate IDs and pull names, email addresses, countries, dates of birth, account roles, and account-deletion status for the app's roughly 719,517 registered users, creating a large-scale phishing and identity-theft risk for what researchers described as a largely elderly, less tech-savvy user base.

Steps to reproduce:

1. Send a GET request to https://api.clicktopray.org/user/users/{id}, where {id} is a numeric user ID.
2. Increment or otherwise vary {id} across the range of registered accounts.
3. Observe that each request returns the corresponding user's name, email, country, birth date, and account status
   without requiring authentication or authorization as that user.

Workaround: None available to end users; this required a server-side fix.

Severity: Major (large-scale PII exposure — email, name, DOB, country — enabling phishing/identity theft against ~720,000 users, but no direct financial loss, account takeover, or service outage reported)

First seen: 2026-01-03 (reported by researcher; the underlying flaw may have existed earlier)
Affected product: Click To Pray
Affected platforms: iOS, Android, and web (clicktopray.org)
Affected versions: All versions/deployments prior to the fix; exact version numbers not published
Fixed versions: Not versioned publicly — fixed via a server-side patch to the API shortly after 2026-07-24

Links:

• Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails (bobdahacker.com) (2026-07-24, updated with fix confirmation)
• Pope's official prayer app commits cardinal sin, leaks 700K+ users' info (The Register) (2026-07-24)
• Vatican's Official Prayer App Leaks 700K+ Global Users' PII (Dark Reading) (2026-07-24)
• Vatican prayer app exposed names and emails of 700,000+ users (Cybernews) (2026-07-24)
• Vatican's Click To Pray app exposed personal data from 700,000 users (Malwarebytes) (2026-07)
• Security flaw in Vatican's 'Click to Pray' app leaves over 700,000 global users exposed (Tom's Hardware) (2026-07)
• Pope's official prayer app exposed data of more than 700,000 users (TweakTown) (2026-07)