Vatican Click to Pray API Flaw Exposes 700K Users

Introduction: Vatican Click to Pray API Flaw — Why It Matters

The Vatican Click to Pray API Flaw has reportedly exposed the personal information of more than 700,000 users through an unauthenticated API vulnerability. The issue affected the Vatican’s official Click to Pray platform n what has become known as the Vatican Click to Pray API Flaw, which offers daily prayers and spiritual content to users worldwide.

According to security reports, the vulnerability stemmed from an Insecure Direct Object Reference (IDOR) issue that allowed anyone to retrieve user records without logging in. Although the incident was not caused by malware or ransomware, it demonstrates how broken access control in web APIs can expose sensitive user information and create opportunities for cybercriminals.

The exposure highlights the growing importance of API security, particularly for organizations that process personal data. Even trusted platforms can become targets when authorization controls are improperly implemented.

What is Click to Pray?

Click to Pray is the Vatican’s official digital prayer platform operated through the Pope’s Worldwide Prayer Network. The service is available through both a website and mobile applications, enabling users across the world to participate in daily prayers, spiritual reflections, and community initiatives.

Users typically create accounts using personal information such as their name and email address. Because the platform stores identifiable user data, securing its APIs and backend infrastructure is essential to maintaining user privacy and trust.

What Caused the Incident?

The Vatican Click to Pray API Flaw was caused by an Insecure Direct Object Reference (IDOR) vulnerability, one of the most common examples of Broken Access Control, which ranks among the OWASP Top 10 Web Application Security Risks.

In an IDOR vulnerability, an application fails to verify whether a user is authorized to access a requested resource. Instead of validating permissions, the application directly returns information based solely on an object identifier, such as a user ID.

In this case, attackers could reportedly modify sequential user IDs within API requests and retrieve information belonging to other users without authentication. Because the application did not properly enforce authorization checks, the flaw made large-scale user enumeration possible.

Ethical hacker BobDaHacker reportedly discovered the issue in January. Security publication DarkReading later verified that the vulnerable endpoint remained accessible at the time of its reporting.

Vatican Click to Pray API Flaw: Full Technical Breakdown

Timeline of Events

• January 2026: Ethical hacker BobDaHacker reportedly discovers the API vulnerability.
• The vulnerability is responsibly reported.
• Security researchers later verify that the exposed endpoint remains accessible.
• Reports indicate that the Vatican Click to Pray API Flaw may have exposed more than 700,000 user records could potentially be accessed through the vulnerable API.

What Data Was Exposed?

The reportedly accessible information included:

• First names
• Last names
• Email addresses
• Country identifiers
• Account deletion status
• User roles

Although passwords and financial information were not reported as exposed in this incident, the disclosed personal data could still be valuable for cybercriminals conducting targeted attacks.

How the Attack Worked

Rather than exploiting malware or compromising servers, the vulnerability relied on weak authorization controls.

The API accepted requests containing sequential user identifiers. By changing these identifiers manually or through automated scripts, an attacker could enumerate user accounts and retrieve associated records without needing valid credentials.

This type of vulnerability is particularly dangerous because it requires relatively little technical sophistication once the vulnerable endpoint is identified.

The incident also demonstrates why API security testing should include authorization validation in addition to authentication testing.

Potential Risks & Impact

Identity and Social Engineering Risks

Although the information exposed in the Vatican Click to Pray API Flaw may appear limited., it can significantly strengthen phishing and impersonation campaigns.

Cybercriminals could potentially use the exposed names and email addresses to craft convincing messages that appear to originate from the Vatican, the Click to Pray platform, or the Pope’s Worldwide Prayer Network.

Potential threats include:

• Targeted phishing emails
• Credential stuffing attempts using previously leaked passwords
• Social engineering attacks
• Account impersonation
• Fraudulent donation requests
• Fake Vatican security notifications

Because the affected platform has a global religious audience, attackers may exploit users’ trust to increase the likelihood of successful scams.

Business and Reputational Risk

Incidents involving unauthorized access to personal information can damage public confidence, even when no malware or financial theft is involved.

For organizations managing large user communities, broken access control vulnerabilities may result in reputational damage, increased security scrutiny, and additional costs associated with remediation, security assessments, and user notifications.

The incident also serves as a reminder that API security deserves the same level of attention as traditional web application security.

Regulatory and Compliance Risk

Organizations handling personal information are expected to implement appropriate security controls to prevent unauthorized access.

Broken authorization mechanisms may attract regulatory attention depending on applicable privacy laws and data protection requirements. Even if only limited personal information is exposed, organizations may still face compliance obligations related to incident investigation, disclosure, and remediation.

Official Response / Statement

At the time of reporting, the Vatican Click to Pray API Flaw had reportedly been identified by an ethical hacker and independently verified by security researchers. However, no detailed public statement explaining the technical root cause or confirming the total number of affected users had been released by the Vatican or the operators of the Click to Pray platform.

Security experts emphasize that incidents involving broken access control should be addressed promptly by implementing proper authorization checks, validating object-level permissions, and conducting comprehensive API security assessments before deployment.

Industry Context: Why API Security Incidents Are Increasing

The Vatican Click to Pray API Flaw is another reminder that API security has become one of the fastest-growing concerns in modern cybersecurity. As organizations increasingly rely on web APIs to power websites, mobile applications, and cloud services, attackers are actively searching for weaknesses in authentication and authorization mechanisms.

Broken Access Control has consistently ranked among the most critical security risks in the OWASP Top 10, largely because a single authorization flaw can expose thousands—or even millions—of user records without requiring malware or sophisticated exploitation techniques.

For readers interested in similar security incidents, explore CyberNexora News’ Cyber Incidents category.To understand how organizations can defend against API-related threats, visit the Learn & Protect section.

For additional API security guidance, OWASP’s API Security Top 10 provides best practices for identifying and mitigating common API vulnerabilities.

How to Protect Yourself and Your Organization

Both users and organizations can reduce the risks associated with API vulnerabilities by following these security practices:

1. Be cautious of unsolicited emails claiming to represent the Vatican, Click to Pray, or the Pope’s Worldwide Prayer Network.
2. Verify communications through official websites before clicking links or providing personal information.
3. Use unique passwords for every online account to reduce the effectiveness of credential stuffing attacks.
4. Enable Multi-Factor Authentication (MFA) wherever available to provide an additional layer of account security.
5. Implement strict authorization checks on every API endpoint instead of relying solely on authentication.
6. Conduct regular API security assessments, including penetration testing and authorization testing.
7. Follow the principle of least privilege, ensuring users and applications can only access resources they are explicitly authorized to use.
8. Monitor API activity for abnormal access patterns, sequential object enumeration, and excessive requests that may indicate exploitation attempts.

For organizations seeking additional cybersecurity guidance, CyberNexora’s Resources section provides practical security references.

Indicators of Compromise (IoCs)

The following indicator is associated with the vulnerable application and should only be used within controlled threat intelligence or security monitoring environments:

• Domain: clicktopray.org

Note: This domain belongs to the legitimate application. Its presence alone does not indicate malicious activity. Analysts should use it only for investigation or contextual threat intelligence.

Key Takeaways

• More than 700,000 users were reportedly exposed through an unauthenticated API vulnerability.
• The incident resulted from an Insecure Direct Object Reference (IDOR) flaw, a form of Broken Access Control.
• Exposed information reportedly included names, email addresses, country identifiers, user roles, and account status.
• The disclosed data could be exploited for phishing, impersonation, social engineering, and credential-based attacks.
• The incident highlights the importance of robust API authorization, continuous security testing, and responsible vulnerability disclosure.

Conclusion: Vatican Click to Pray API Flaw and What Happens Next

The Vatican Click to Pray API Flaw illustrates how even well-established organizations can face significant cybersecurity risks when API authorization controls are overlooked. While the incident did not involve malware or ransomware, the exposure of personal information demonstrates the real-world impact of Broken Access Control vulnerabilities.

Going forward, organizations should prioritize secure API development, regular authorization testing, and continuous monitoring to prevent similar incidents. Users, meanwhile, should remain alert for phishing attempts that exploit publicized security incidents and always verify communications through official channels before responding.

For more cybersecurity news and security awareness content, visit CyberNexora News’ Cyber Incidents and Learn & Protect categories.