The Vatican's official Click To Pray app, personally promoted by Pope Francis back in January 2019, spent months leaking the names, email addresses, dates of birth, and account details of over 700,000 users through one of the most elementary API oversights imaginable. The flaw has now been patched, but only after white-hat hacker BobDaHacker went public with the findings on July 24, 2026, following seven months of unanswered emails to Vatican contacts.
How a sequential ID became a skeleton key
Here's the thing: the vulnerability itself was not sophisticated. When a user registered for Click To Pray, the app's backend assigned them a sequential numeric ID. User one, user two, user three, and so on, all the way past 700,000. The problem was that the API endpoint at https://api.clicktopray.org/user/users/[ID] required no authentication whatsoever. Plug in any number, get back that user's full profile.
No authorization check. No ownership validation. Just increment the ID and collect someone else's data. The exposed fields included first name, last name, email address, country, date of birth (stored in the backend under the field name borned_date, because apparently ecclesiastical Latin is not the only language struggling here), account role, and whether the account had been deleted.
The response headers also identified the server as running Express, the Node.js web framework. As BobDaHacker put it, the Vatican was running its prayer infrastructure on the framework you learn in week two of a Node.js bootcamp.
Seven months of silence before the fix
BobDaHacker discovered the flaw in early January 2026 and emailed nine separate Vatican and Click To Pray-related contacts on January 3rd. Not one responded. The vulnerability sat open for the entirety of that silence, completely unaddressed.
The situation only changed after BobDaHacker brought the findings to a journalist and published the July 24 blog post. Shortly after, the endpoint quietly stopped returning other users' data. No public acknowledgment, no disclosure, no word to the researcher who flagged it. The fix is now live: requesting your own user ID still returns your profile, while requesting another user's ID returns only their public-facing information.
The legitimate emails from Click To Pray were also generating authentication warnings in mail clients, flagging as potential phishing before the patch. The real app emails were already behaving like the fake ones a bad actor would send.
Why this particular data set was dangerous
The people using a Pope-endorsed prayer app skew toward an older, less technically experienced demographic. BobDaHacker's assessment was direct: this data represented a phishing goldmine. An attacker with access to 700,000 verified names, emails, and countries, all associated with a high-trust religious institution, could craft convincing targeted messages that a large portion of recipients would act on without hesitation.
The scenario writes itself. An email claiming urgent attention from the Holy Father, with a Vatican-adjacent domain and the recipient's correct name, would have an extremely high click rate among that user base. The fact that legitimate Click To Pray emails were already triggering spam warnings made the situation worse, not better. Users had no reliable way to distinguish real communication from a spoofed version.
What most players miss in security stories like this is that the technical simplicity of the exploit is the most damning part. This was not a zero-day. It was not a sophisticated supply chain attack. It was a missing if statement on an API route, the kind of oversight that gets flagged in a first code review at any serious software shop.
For broader context on how digital systems and their underlying infrastructure decisions play out in unexpected ways, the Nova Roma religion guide is a good reminder that even in games, the systems you build on top of weak foundations tend to collapse at the worst possible moment.
The before and after of Click To Pray's API
The fix is functional, but the timeline tells the real story. Seven months elapsed between responsible disclosure and remediation. The patch only arrived after public pressure, with no communication to the researcher who found the problem. For an app with hundreds of thousands of users tied to one of the world's most recognizable institutions, that response time is a serious failure of basic security practice.
If you want to understand how trust systems and infrastructure decisions interact in ways that matter, our gaming guides hub covers plenty of games where the architecture you choose early determines everything that follows. The Vatican, it turns out, could have used a similar lesson before launch.
The Click To Pray app remains available. If you are signed up, your data should now be protected behind the authorization check that should have been there from day one. The Nova Roma tech tree guide aside, the broader takeaway here is simple: sequential IDs plus public API endpoints plus no auth equals a breach waiting to happen, and 700,000 people paid the price for that equation while the Vatican's inbox stayed quiet for half a year.
