Security researcher BobDaHacker published a detailed analysis of Click to Pray, the official application of the Pope's Worldwide Prayer Network, revealing a critical authorization flaw. At the time of discovery the service contained 719,517 registered accounts whose numeric IDs were fully sequential and predictable.
The vulnerable endpoint accepted direct requests such as GET https://api.clicktopray.org/user/users/12345 and returned complete profile information without verifying whether the requester was authorized to view the data. Changing the ID to 12346 immediately exposed another user record containing name, surname, email address, country, date of birth, role, and several internal fields. No rate limiting was implemented, allowing systematic enumeration of the entire user base.
The vulnerability is a classic example of Insecure Direct Object Reference (IDOR), also known as Broken Object Level Authorization (BOLA) in the OWASP API Security Top 10. Exploitation required no advanced techniques, only the ability to increment an integer. Additional minor issues included the misspelled field borned_date and the user role value PRAYER.
BobDaHacker first notified nine recipients in January 2026, including the general contact address, six service employees, and two representatives of the Pope's Worldwide Prayer Network. No replies or fixes followed. In July the researcher shared the findings with Dark Reading, whose journalists independently confirmed the exposure and attempted contact with both the network and the development agency La Machi. Again no responses were received.
Following public disclosure on 24 July the endpoint was modified the same day. Requests for other users’ IDs now return only public name and surname fields, while authenticated users can still view their own full records. The researcher learned of the fix through a Reddit comment rather than direct communication.
The incident echoes a 2019 security review of the related Click to Pray eRosary electronic rosary application. At that time researchers from Fidus Information Security found that four-digit PIN codes could be retrieved in plaintext via the sendPIN and resetPIN API calls, enabling immediate account takeover. Those specific issues were addressed after media coverage, yet the underlying pattern of missing authorization checks reappeared years later.
