The Register38%
Pope's official prayer app commits cardinal sin, leaks 700K+ users' info 40%
7/24/2026, 10:19:16 PM
BS Summary: This article contains 22 faulty reasoning types, including Anecdotal, Availability Heuristic, and Burden of Proof, with Negativity Bias as the most egregious example at 31.7% saturation with 208 hits. Analysis detected 1,005 faulty-reasoning hits from 657 analyzed words, generating a BS Score of 44.9% and a BS Rank of 40% (13,266 of 21,886 articles). This article is better (less manipulative) than 60.60% of the article peer group.
Click To Pray, a prayer app endorsed by the Pope with hundreds of thousands of users worldwide, has leaked people’s names and email addresses for months - or longer - according to an ethical hacker who said she found and reported the security vulnerability six months ago to no avail.
This app needs to take a vow of silence when it comes to your personal information.
The app, available in seven languages and on iOS, Android, and clicktopray.org, is the official app of the Pope's Worldwide Prayer Network.
It connects users across the globe to pray for the Holy Father’s intentions, and as of July 2026, it has 719,517 registered accounts.
It’s also very leaky, according to security sleuth BobDaHacker, who says she spotted and disclosed the vulnerability to the Pope’s Worldwide Prayer Network on January 3.
“The vulnerability is still live,” the hacker said in a Friday blog.
“Nobody has ever responded.
I guess my email wasn't in their prayers."
The Reg readers likely remember BobDaHacker for her previous research exposing a free-food flaw in McDonald's ordering system and open controls on Chinese robot manufacturer Pudu Robotics.
This latest security hole stems from an Insecure Direct Object Reference (IDOR) bug in the prayer app.
This is a very common and easy-to-exploit type of flaw that occurs when a website or an app blindly accepts user-provided input to view or modify resources without checking to see if the user is actually authorized to retrieve the data.
“You ask for your own data, the server gives it to you,” BobDaHacker explains.
“You ask for someone else's data, the server gives you that too.
Thou shalt not authorize, apparently.”
When you sign up for a Click To Pray account, the app assigns you a sequential numeric user ID.
As BobDaHacker uncovered, the API endpoint GET https://api[.]clicktopray.org/user/users/{id} will return user data for any account - not just your own account - so long as you supply a valid, five-digit user ID.
It doesn’t perform any authorization check or ownership validation.
“Just increment the number and get someone else's data,” she wrote.
This data includes users’ email addresses, first and last names, country, dates of birth, and whether the account has been deleted, and the API exposes all 719,517 accounts on the prayer site.
“With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform,” the hacker explained.
“One GET request per user. for i in range(1, 719518): scrape().
That's it.
That's the exploit.”
As BobDaHacker points out, many of these users are likely older individuals, not all that tech savvy, and very trusting of anything Vatican related, making these exposed accounts a “phishing goldmine.”
“Imagine getting an email that says ‘The Holy Father requests your urgent attention’ with a Vatican-looking link,” she wrote.
“Grandma is clicking that.
Every time.”
And then it gets even worse.
The signup endpoint, POST https://api.clicktopray.org/user/users/sign-up, returns the account's validation_hash directly in the response body, and that value is the same UUID used in the email verification link.
This means someone could sign up using any email address and verify the account before the confirmation message reached the inbox.
Plus, BobDaHacker’s email client flagged the real verification email with a warning that it had failed the domain’s authentication requirements and might have been spoofed or improperly forwarded.
“So not only is the API leaking 700,000 email addresses that could be used for phishing, but the real emails from Click To Pray already look like phishing,” the hacker noted.
“An attacker wouldn't even need to try hard.
They could send a pixel-perfect phishing email and it would have the same level of email authentication as the real thing: none.
God works in mysterious ways.”
The Register reached out to the Pope's Worldwide Prayer Network and did not receive any response.
BobDaHacker says she’s still praying for one, too.
®
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.