--- title: Vatican's Official Prayer App Leaks 700K+ Global Users' PII description: The Vatican's official prayer app 'Click to Pray' has been leaking personally identifiable information of over 700,000 users via an exposed, unauthenticated... canonical: https://daily.dev/posts/vatican-s-official-prayer-app-leaks-700k-global-users-pii-c6hg6dxss twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Vatican's Official Prayer App Leaks 700K+ Global Users' PII | daily.dev og:description: The Vatican's official prayer app 'Click to Pray' has been leaking personally identifiable information of over 700,000 users via an exposed, unauthenticated... og:url: https://daily.dev/posts/vatican-s-official-prayer-app-leaks-700k-global-users-pii-c6hg6dxss og:image: https://api.daily.dev/og/posts/c6HG6DxSS.png og:image:alt: Vatican's Official Prayer App Leaks 700K+ Global Users' PII og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Vatican's Official Prayer App Leaks 700K+ Global Users' PII **[Dark Reading](https://daily.dev/sources/dr)** · 6 min read · 0 upvotes · 0 comments ## Summary The Vatican's official prayer app 'Click to Pray' has been leaking personally identifiable information of over 700,000 users via an exposed, unauthenticated API endpoint. The vulnerability, an insecure direct object reference (IDOR), allows anyone to enumerate user accounts by supplying sequential user IDs in a browser, exposing names, email addresses, countries of origin, and admin status. Discovered in January by white hat hacker BobDaHacker, the issue remained unpatched at time of publication despite outreach to the app's operators. The flaw highlights a common developer mistake: frameworks handle authentication but not authorization, leaving object-level access checks to developers who often skip them. Users can partially protect themselves by using anonymized names and Apple's Hide My Email feature when registering for apps. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerability is exposing user data in the Vatican's Click to Pray app? An insecure direct object reference (IDOR) flaw in an unauthenticated API endpoint lets anyone enumerate sequential user IDs and retrieve names, email addresses, country codes, account status, and role (including admin accounts). Over 700,000 accounts are exposed in plaintext with no login required, discovered by researcher BobDaHacker and confirmed still live by Dark Reading. _daily.dev surfaces writeups like this for developers auditing their own APIs for missing authorization checks._ ### Why do IDOR vulnerabilities keep happening across different applications and tech stacks? Most frameworks handle authentication (checking if a user is logged in) but leave authorization (checking if that user should access a specific resource) entirely up to the developer to implement. This second check is easy to forget when building features quickly, making IDOR the most common form of Broken Access Control, the top OWASP vulnerability category since 2021. _developers hardening authorization logic can find real-world IDOR breakdowns like this on daily.dev._ ### How can users protect themselves from apps with leaky APIs before the developer fixes the bug? Using abbreviated names or alphanumeric handles instead of real names during signup, and relay email services like Apple's Hide My Email, keeps personal data out of reach even if a site's endpoint leaks account records. Click to Pray users who did this had their identities protected despite the exposed API. _privacy-conscious developers weighing signup data minimization can track incidents like this via daily.dev._ ## Similar posts on daily.dev - [UStrive security lapse exposed personal data of its users, including children](https://daily.dev/posts/ustrive-security-lapse-exposed-personal-data-of-its-users-including-children-zyqyqoybz) · TechCrunch · 0 upvotes · 0 comments - [How I found an unauthenticated goldmine of PII](https://daily.dev/posts/how-i-found-an-unauthenticated-goldmine-of-pii-8jmk2nrvi) · InfoSec Write-ups · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/vatican-s-official-prayer-app-leaks-700k-global-users-pii-c6hg6dxss) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Vatican's Official Prayer App Leaks 700K+ Global Users' PII","url":"https://daily.dev/posts/vatican-s-official-prayer-app-leaks-700k-global-users-pii-c6hg6dxss","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/vatican-s-official-prayer-app-leaks-700k-global-users-pii-c6hg6dxss"},"datePublished":"2026-07-24T13:00:03.721Z","dateModified":"2026-09-13T20:06:20.238Z","description":"The Vatican's official prayer app 'Click to Pray' has been leaking personally identifiable information of over 700,000 users via an exposed, unauthenticated...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3ca04656a79ef76e7dfe97400ff20131?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3ca04656a79ef76e7dfe97400ff20131?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/vatican-s-official-prayer-app-leaks-700k-global-users-pii-c6hg6dxss","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Vatican's Official Prayer App Leaks 700K+ Global Users' PII"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/vatican-s-official-prayer-app-leaks-700k-global-users-pii-c6hg6dxss#faq","mainEntity":[{"@type":"Question","name":"What vulnerability is exposing user data in the Vatican's Click to Pray app?","acceptedAnswer":{"@type":"Answer","text":"An insecure direct object reference (IDOR) flaw in an unauthenticated API endpoint lets anyone enumerate sequential user IDs and retrieve names, email addresses, country codes, account status, and role (including admin accounts). Over 700,000 accounts are exposed in plaintext with no login required, discovered by researcher BobDaHacker and confirmed still live by Dark Reading. daily.dev surfaces writeups like this for developers auditing their own APIs for missing authorization checks."}},{"@type":"Question","name":"Why do IDOR vulnerabilities keep happening across different applications and tech stacks?","acceptedAnswer":{"@type":"Answer","text":"Most frameworks handle authentication (checking if a user is logged in) but leave authorization (checking if that user should access a specific resource) entirely up to the developer to implement. This second check is easy to forget when building features quickly, making IDOR the most common form of Broken Access Control, the top OWASP vulnerability category since 2021. developers hardening authorization logic can find real-world IDOR breakdowns like this on daily.dev."}},{"@type":"Question","name":"How can users protect themselves from apps with leaky APIs before the developer fixes the bug?","acceptedAnswer":{"@type":"Answer","text":"Using abbreviated names or alphanumeric handles instead of real names during signup, and relay email services like Apple's Hide My Email, keeps personal data out of reach even if a site's endpoint leaks account records. Click to Pray users who did this had their identities protected despite the exposed API. privacy-conscious developers weighing signup data minimization can track incidents like this via daily.dev."}}]} ```