Vatican Prayer App Data Exposure Highlights Global IDOR Security Risks

A high-profile security oversight involving the global digital prayer platform, Click To Pray, has drawn renewed attention to the persistent threat of insecure direct object reference (IDOR) vulnerabilities. Security researchers discovered that the application exposed the sensitive information of more than 700,000 users, leaving their profiles accessible through simple manipulation of numeric identifiers.

The Anatomy of the Exposure

The core of the issue lay in the platform’s API design. Every user was assigned a sequential numeric ID upon registration. Because the backend failed to implement adequate authorization checks, the system responded to requests for these IDs by returning full user profiles. An unauthorized party could systematically increment these numbers to scrape the entire database, effectively exposing names, email addresses, birth dates, country affiliations, and account statuses.

This type of flaw—IDOR—occurs when an application provides direct access to objects based on user-supplied input without verifying if the requesting user has the right to access that data. It remains one of the most common and damaging tech-security oversights in modern web development.

The Risk of Mass Enumeration

When an application lacks rate limiting and uses predictable sequential IDs, it becomes trivial for an attacker to perform mass enumeration. In this instance, over 700,000 accounts were rendered vulnerable. For a platform serving a global community, this exposure represents a significant failure in data-protection principles, as the combination of emails and personal details provides a ready-made dataset for malicious actors.

Beyond the Database: Authentication Failures

The investigation revealed that the vulnerability was not limited to the data exposure alone. The platform also suffered from critical flaws in its email verification and authentication infrastructure. Researchers noted that the system returned the same verification token in the API response that it sent via email, effectively rendering the verification process useless. Furthermore, the absence of proper SPF, DKIM, and DMARC configurations meant that phishing emails sent to these users would appear legitimate, making them indistinguishable from official communications.

The Gap in Vulnerability Disclosure

Perhaps as concerning as the technical flaw was the handling of the discovery. Despite the researcher reporting the vulnerability in early January 2026 to multiple staff contacts, the issue remained unresolved for six months. This extended delay highlights the critical need for organizations to establish and maintain functional, responsive vulnerability disclosure programs.

Security Lessons for Developers

• Implement robust authorization: Never rely on client-side requests to determine access rights. Always validate that the logged-in user is authorized to view the specific object requested.
• Avoid predictable IDs: Use Universally Unique Identifiers (UUIDs) instead of sequential numeric sequences to prevent enumeration attacks.
• Enforce rate limiting: Limit the frequency of API requests to prevent mass scraping and automated enumeration.
• Configure email security: Ensure SPF, DKIM, and DMARC records are correctly implemented to prevent email spoofing and protect users from phishing.

Conclusion: Accountability in Digital Safety

The resolution of this issue, which finally occurred after public reporting, serves as a sobering reminder that even platforms focused on spiritual outreach must adhere to rigorous cybersecurity standards. For developers and privacy professionals, the incident reinforces that authorization is not an optional feature—it is a fundamental requirement of modern web architecture. As the digital landscape continues to expand into every facet of life, maintaining the data-protection integrity of these platforms must remain a top priority to maintain digital trust.