A prayer app launched by Pope Francis in 2019 spent months handing out its users personal details to anyone who asked for them. Click To Pray, the app of the Pope Worldwide Prayer Network, carried a flaw that let anyone retrieve the email address, first and last name, country and date of birth of any registered user. There were more than 719,000 registered accounts. The flaw was fixed only this month, over six months after it was first reported.
It was found in January 2026 by an independent researcher who goes by BobDaHacker. The app back end, the online service the mobile app queries for data, identified users by simple sequential numbers, and it never checked whether whoever was asking had any right to see the record. Walk the numbers from 1 up to 719,517 and you walk away with the entire user base.
That class of flaw has a name, insecure direct object reference or IDOR, and it is one of the most common ways consumer apps leak personal data. Exploiting it needs no exploit code and no malware, only a browser and patience.
A second flaw allowed account takeover
The researcher found a related problem in how the service verified email addresses. When someone registers, the service normally emails them a link containing a unique validation code to prove they control the inbox. The Click To Pray back end also returned that validation code in its own web response, which anyone can read using a browser built-in developer tools. In practice an attacker could register an account with an email address they did not control and confirm it before the real owner ever saw the verification message.
Nine emails, no reply
The disclosure timeline is the part security teams should sit with. BobDaHacker reported the bug on January 3, 2026 and eventually wrote to nine separate addresses spanning the Click To Pray service, the Pope Worldwide Prayer Network and a general information line. None replied. The flaws were fixed only after the researcher approached a journalist, who put a query to the Vatican directly. Coordinated disclosure only works when somebody is on the other end of it, and nine unanswered emails is a loud signal that no intake process exists.
It is not the first time. In 2019, researchers at Fidus Information Security found that the app for the Vatican Bluetooth eRosary device returned users login PINs in plain text in its own web responses, allowing trivial account takeover. Different app, same shape of mistake, more than six years apart. Vatican City State introduced its own data protection regulation, Decree No. DCLVII, in April 2024, requiring appropriate safeguards for personal data, though it is not clear whether it applies directly to Click To Pray or to the organizations that run it. Our Vatican City profile tracks that picture.
What affected users should do
If you registered for the app, assume your name, email address, country and date of birth were reachable by anyone who cared to look, for a long stretch. Treat any message referencing the app with suspicion, especially anything asking you to click, verify or log in. That caution matters more than usual here because the researcher also reported that emails from the service failed standard sender authentication checks, which makes convincing impersonation easier for a phishing campaign. Consumer apps quietly exposing personal data remains a recurring pattern, as the recent robot vacuum flaw that exposed home camera feeds and Wi-Fi passwords showed. The full write-up of the findings is available here.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.