The Pope’s Official Prayer App Sends Your Prayers to the Almighty—And Your Data to Hackers

A security flaw in the Pope’s official prayer app and online prayer platform, Click to Pray, has exposed personal data from over 719,000 accounts. Users’ full names, birthdates, and more have leaked through an insecure API endpoint in a data disaster that’s remained open for months after its discovery.

The flaw stems from a broken access control channel, also known as an IDOR issue, Tom’s Hardware reports. Put simply, the app provides account data to anyone who enters a user ID into the API endpoint, even if that account doesn’t belong to them.

BobDaHacker, the white-hat hacker and security enthusiast who located the vulnerability, says they reached out to nine different people in an attempt at responsible disclosure. That was back in January, and the vulnerability still has not been addressed, they say.

The exposed data includes names, birthdates, email addresses, countries of origin and residence, and in some cases, role details tied to the account. Though a breach of this nature doesn’t sound as threatening as one involving, say, bank details or Social Security numbers, even mundane personal details can make it easier for attackers to succeed in phishing or impersonation. In a case like this, attackers could use the exposed names and email addresses to send out convincing messages that appear to come from the Vatican-linked service or related groups.

“To Click to Pray: Your app is endorsed by the Pope,” BobDaHacker writes. “Hundreds of thousands of faithful users trusted you with their email addresses when they signed up to pray together. Fix the IDOR…Your users deserve better.”