The Vatican’s official prayer application, “Click to Pray,” has suffered a significant data exposure affecting over 700,000 users worldwide. According to Dark Reading, an insecure API endpoint allowed unauthenticated access to sensitive user information. The leaked data includes full names, email addresses, geocoordinates, and user status, creating a substantial risk for Phishing campaigns and potential physical security threats.
Technical Analysis of the API Vulnerability
The exposure stems from a poorly secured API that interacts with the “Click to Pray” backend. Security researchers identified that the endpoint did not require robust authentication to query user records. This type of PII exposure in mobile applications is frequently the result of developers prioritizing ease of access or cross-platform synchronization over stringent security protocols.
By simply using a standard web browser, researchers were able to retrieve structured data containing the personal details of the app’s global user base. This vulnerability highlights a failure in implementing proper authorization checks at the API layer. In many cases, these flaws occur when internal IDs are used as parameters in API calls without verifying that the requester has the rights to view the associated data. While no specific CVE has been assigned to this configuration error, the underlying TTP of exploiting insecure endpoints remains a common vector for large-scale data exfiltration.
How to Detect Insecure API Endpoint Data Leaks
When an API lacks authentication, it effectively provides a public gateway to the underlying database. For the Vatican’s app, this meant that an attacker could automate the collection of 700,000 records without triggering traditional security alerts. For a SOC, detecting this type of activity is challenging because the requests often mimic legitimate traffic, especially if the API is designed to support a high volume of global users. Organizations must understand how to detect insecure API endpoint data leaks by monitoring for anomalous traffic patterns, such as a single IP address requesting an unusually high number of unique user profiles in a short timeframe.
Impact on Global User Privacy
The inclusion of location data (geocoordinates) elevates this incident from a standard PII leak to a safety concern. High-profile individuals or residents in regions where religious activities are monitored could be targeted for physical surveillance or harassment. Furthermore, the combination of names and emails allows attackers to craft highly convincing phishing lures. An attacker could impersonate Vatican officials or app administrators, referencing specific user “site status” or recent prayer activity to gain trust.
The absence of a formal CVE identifier for this flaw does not diminish its severity. The lack of encryption or access control on the data-in-transit via the API means that the records were essentially public. For users, this exposure is permanent; once PII is scraped and enters the dark web or threat actor databases, it becomes a permanent IoC for identity theft and social engineering.
Mitigation and Defense Strategies
Defenders and application developers should prioritize the following actions to prevent a Vatican Click to Pray app security flaw from appearing in their own environments:
- Implement Strict Authentication: All API endpoints, especially those serving PII, must require valid authentication tokens, such as OAuth2 or JWT.
- Rate Limiting and Throttling: Deploy rate limiting on API gateways to prevent automated scraping of the entire user database.
- Data Minimization: Evaluate whether the API needs to expose sensitive fields like geocoordinates. If the data is not necessary for functionality, it should be redacted at the API layer.
- Continuous Monitoring: Integrate API logs into a SIEM to identify mass data retrieval attempts that deviate from normal user behavior.
Organizations utilizing third-party mobile applications for institutional communication must conduct regular security assessments to identify porous endpoints. Ensuring that APIs are subjected to rigorous penetration testing can prevent these vulnerabilities from becoming significant liabilities.
Related: Medtronic Data Breach: ShinyHunters Campaign Exposes Customer PII, Cisco Secure Workload RCE via CVE-2025-20165 — Mitigation Guide