Vatican’s Click To Pray App Exposed User Data Due to API Flaws A security vulnerability in Click To Pray, a prayer app launched by Pope Francis in 2019, exposed the personal data of over 700,000 users before being fixed earlier this year. The app, developed by La Machi Communication for Good Causes for the Pope’s Worldwide Prayer Network, offers daily prayers and a digital prayer community. Independent researcher BobDaHacker discovered two critical flaws in the app’s API in January 2026. The first was an Insecure Direct Object Reference (IDOR) vulnerability, where the API returned user records including email addresses, full names, countries, and dates of birth to anyone who requested them, without proper authorization checks. The app assigned sequential numeric IDs to users, allowing attackers to cycle through all 719,517 registered accounts. A second flaw compounded the risk: the API exposed validation hashes in email verification responses, enabling attackers to hijack accounts by registering with an email they didn’t own and verifying it before the legitimate user could. Despite reporting the issue to nine different email addresses associated with the app and the Vatican, the researcher received no response. The flaws were only addressed after a journalist intervened, highlighting gaps in the Vatican’s vulnerability disclosure process. This isn’t the first security lapse involving a Vatican-affiliated app. In 2019, a flaw in the eRosary app exposed login PINs in plaintext, allowing account takeovers a similar issue to the one found in Click To Pray. While Vatican City introduced its own data protection regulation (Decree No. DCLVII) in April 2024, it remains unclear whether it applies to the app or its operators. The exposed data, which may have been circulating for months, increases the risk of phishing attacks, particularly since the app’s emails failed standard authentication checks, making impersonation easier.