BobDaHacker

Click to Pray App Exposed Personal Data of 719,000 Users Through Unprotected API Endpoint

Security researcher BobDaHacker discovered an IDOR vulnerability in the official Click to Pray application run by the Pope's Worldwide Prayer Network. The flaw allowed anyone to retrieve full user profiles, including names, emails, countries, and birth dates, by simply incrementing numeric user IDs in API requests. No authorization checks or rate limits were present on the endpoint despite the service holding data for over 719,000 registered accounts. The researcher reported the issue to nine contacts in January 2026 but received no response for seven months. Dark Reading independently verified the exposure before publication, after which the endpoint was quickly restricted. The same service had suffered similar authorization failures in 2019 involving PIN code exposure through its eRosary application. The case highlights persistent gaps in object-level authorization and responsible disclosure channels at the Vatican-backed platform.