Click To Pray leak exposed data for more than 700,000 users, hacker says
An ethical hacker says the Pope-endorsed prayer app exposed user profiles through an IDOR flaw that went unfixed for six months.
By Dominic Okoye · Staff Writer
· 3 min read
The Click To Pray leak exposed personal data tied to more than 700,000 accounts, according to ethical hacker BobDaHacker, who said she reported the flaw to the Pope’s Worldwide Prayer Network on January 3 and received no reply. The app, endorsed as the official app of the Pope’s Worldwide Prayer Network, had 719,517 registered accounts as of July 2026, and the alleged bug created an easy path to enumerate user profiles at scale.
Click To Pray is available on iOS, Android and the web at clicktopray.org, and supports seven languages. It is designed to connect users around the world to pray for the Pope’s intentions. BobDaHacker said in a Friday blog post that the vulnerability was still live six months after disclosure.
What caused the Click To Pray leak?
BobDaHacker said the problem was an Insecure Direct Object Reference, or IDOR, in the app’s API. An IDOR occurs when an application accepts a user-supplied identifier and returns a resource without checking whether the requester is allowed to access it.
According to the researcher, each Click To Pray account is assigned a sequential numeric user ID. She said the API endpoint for retrieving user records would return account data for any valid five-digit ID, rather than only the authenticated user’s own profile. With sequential IDs and no rate limiting, she said an attacker could request records one by one and enumerate every account on the service.
The exposed data included email addresses, first and last names, country, dates of birth and whether an account had been deleted, according to BobDaHacker. The Register reported that it contacted the Pope’s Worldwide Prayer Network and did not receive a response.
Why the exposed data is risky
The data described by BobDaHacker is enough to support targeted phishing. She argued that many users of a Vatican-related prayer app may be more likely to trust religiously themed emails, especially if the messages use names, countries or other profile details pulled from the service.
The researcher also flagged a separate issue in the account creation process. She said the signup endpoint returned the account’s validation_hash in the response body, and that the same UUID was used in the email verification link. On her account, that would allow someone signing up with an email address to verify the account before the confirmation email arrived in the inbox, according to her write-up.
BobDaHacker further said her email client warned that Click To Pray’s real verification message failed the domain’s authentication requirements and might have been spoofed or improperly forwarded. If accurate, that weakens the difference between legitimate account emails and phishing attempts using similar branding.
The claims have not been publicly answered by the Pope’s Worldwide Prayer Network. The organization has not disclosed whether any third party accessed the exposed records, whether it has fixed the API behavior, or whether affected users will be notified.
This story draws on original reporting from The Register.
