Security flaw in Vatican’s ‘Click to Pray’ app leaves over 700,000 global users exposed — app has been leaking user data for over six months and still does

Click To Pray, a Vatican-linked prayer app, exposed user data through an insecure API that allowed access via sequential user IDs.

The leak included names, email addresses, and birthdates for hundreds of thousands of users, with little protection such as rate limiting.

A security researcher reported the flaw in January 2026, but the operators did not respond for months.

After public reporting by a journalist, the vulnerability was patched.