The Vatican’s official Click To Pray platform has fixed a security vulnerability that exposed personal information belonging to more than 719,000 registered users after the issue reportedly remained unresolved for more than six months. The flaw was discovered by an independent security researcher, who said repeated disclosure attempts received no response before the vulnerability was eventually patched.
Click To Pray is available through its website and mobile applications for Android and iOS. The service provides daily guided prayers and allows users around the world to participate in prayer initiatives promoted by the Pope’s Worldwide Prayer Network.
Security researcher BobDaHacker said she first identified the vulnerability on January 3, 2026. According to her disclosure, she notified multiple contacts associated with Click To Pray and the Pope’s Worldwide Prayer Network, including general support addresses and individual staff members, but did not receive an acknowledgement or a response.
At the time of testing in July, the platform contained 719,517 registered user accounts. The researcher said the issue remained unpatched throughout that period.
The vulnerability was an Insecure Direct Object Reference (IDOR), a type of access-control flaw that occurs when an application exposes internal object identifiers without properly checking whether a user is authorised to access the requested information.
According to the disclosure, every account was assigned a sequential numerical identifier. By replacing their own account ID with another valid number in an application programming interface (API) request, an authenticated user could retrieve another person’s account information because the system failed to verify ownership before returning the data.
The exposed information reportedly included users’ email addresses, first and last names, countries, dates of birth, account roles, and indicators showing whether an account had been deleted. The researcher said the predictable numbering system, combined with the absence of rate limiting, meant an attacker could have systematically queried every registered account.
Although there is no evidence that the vulnerability was exploited maliciously, the researcher warned that exposed email addresses and personal details could have been used to craft convincing phishing or social engineering attacks targeting members of the platform.
During the assessment, BobDaHacker also identified a weakness in the application’s email verification process. According to the disclosure, the API returned the same verification token that the system later sent by email, allowing users to activate accounts without actually accessing the registered mailbox.
The researcher additionally reported problems with the platform’s email authentication configuration. She said SPF, DKIM and DMARC protections appeared to be improperly configured, making legitimate messages difficult to distinguish from fraudulent emails. These standards are designed to help receiving mail servers verify that emails originate from authorised senders and have not been altered during delivery.
The Pope’s Worldwide Prayer Network did not respond to the researcher’s disclosure attempts or subsequent requests for comment before the issue became public, according to the published timeline.
The situation changed after Dark Reading reported on the vulnerability. BobDaHacker later confirmed that the application had been updated and that the access-control flaw had been corrected.
Following the fix, requests for another user’s profile return only information intended to be publicly visible, such as first and last names. Sensitive account details, including email addresses, birth dates and country information, are no longer exposed through the affected API endpoint.
Although she said she never received a direct acknowledgement from the organisation, the researcher welcomed the remediation. She stated that the primary objective of responsible disclosure had been to ensure the vulnerability was fixed, adding that the issue had ultimately been resolved correctly.