Vatican’s Click To Pray App Exposed 700,000 Users’ Data Due to Basic API Flaw In a stark example of avoidable security failures, the Vatican’s Click To Pray app personally endorsed by Pope Francis in 2019 leaked the personal data of over 700,000 users for months due to an elementary API vulnerability. The flaw, discovered by white-hat hacker BobDaHacker in January 2026, was only patched on July 24, 2026, after seven months of unanswered disclosure attempts. The issue stemmed from a sequential user ID system in the app’s backend API. By simply incrementing a numeric ID in the endpoint `https://api.clicktopray.org/user/users/[ID]`, anyone could access full user profiles including names, email addresses, dates of birth, countries, and account roles without authentication. The server, running on the basic Express Node.js framework, lacked rate limiting, allowing automated scraping of the entire dataset. Despite multiple emails to Vatican and app contacts, the vulnerability remained unaddressed until BobDaHacker went public. The fix, implemented silently after the disclosure, now restricts access to a user’s own data while exposing only public-facing details for others. Notably, legitimate app emails had also triggered phishing warnings in mail clients, further eroding user trust. The exposed data posed significant risks, particularly for the app’s predominantly older, less tech-savvy user base. With verified names, emails, and ties to a high-trust religious institution, attackers could craft highly convincing phishing campaigns. The incident underscores how even basic oversights like a missing authentication check can lead to large-scale breaches, especially when compounded by delayed responses from institutions. The Click To Pray app remains available, with user data now secured behind the authorization controls that should have been in place from the start. The case serves as a reminder of the consequences when foundational security practices are overlooked.