The Vatican’s official prayer app, Click to Pray — created by the Pope’s Worldwide Prayer Network and used by hundreds of thousands of Catholics around the world — has been quietly leaking its users’ personal information for at least six months, and the leak is still live at the time of writing. A researcher known as BobDaHacker discovered the flaw on January 3, 2026 and reported it to the Vatican; six months later, after receiving no response, they and journalists at The Register went public. The exposed information covers 719,517 registered accounts and includes full names, email addresses, dates of birth, and country of residence — enough for anyone on the internet to build a highly targeted phishing list against a trusting, largely older audience.
The problem is a common web-programming mistake called an Insecure Direct Object Reference (IDOR): the app’s back-end API at api.clicktopray.org returns a user’s profile whenever asked, without checking whether the person asking is entitled to see it. All an attacker needs is to loop through numeric user IDs. A separate flaw in the sign-up flow also returns the email-verification code directly in the response, which means an attacker could confirm an account before the real email even arrives. Neither the Vatican nor the Pope’s Worldwide Prayer Network has publicly acknowledged the issue as of publication.
How to check if you’re affected
Affected products are the Click to Pray mobile app (on iPhone and Android) and the clicktopray.org website — anyone who ever signed up before July 25, 2026 is exposed. There is no way for a user to check the leak directly, but if you have an account, assume your name, email, date of birth and country are already in the hands of anyone who wanted them. Watch your inbox for phishing emails that name you personally and mention “Click to Pray,” the Vatican, or Catholic causes, and treat any donation, “prayer request,” or “account verification” email that arrives out of the blue as suspicious. If you use the same email address for other important accounts, make sure each has a unique password and, ideally, two-factor authentication turned on. You can also request account deletion from within the app, but that will not undo what has already leaked.
Sources
- The Register — Pope’s official prayer app commits cardinal sin, leaks 700K+ users’ info
- Dark Reading — Vatican’s Official Prayer App Leaks 700K+ Global Users’ PII (URL blocked to non-browser clients; cite by name)
- Straight Arrow News — The Pope’s prayer app has been leaking its users’ info for months