A vulnerability in the pope’s official prayer app, Click To Pray, has reportedly left the information of its nearly 720,000 users exposed.

The exposure, according to security researcher “BobDaHacker,” has been ongoing for at least six months and includes users’ names, email addresses and countries of origin.

Download the Straight Arrow app today to get the stories that matter free from manipulation, bias or agenda.™

Point phone camera here

In a Friday blog post, the researcher said they reached out to nine email addresses associated with the app to report the issue on Jan. 3 but never heard back. As of July, the researcher counted 719,517 registered accounts. 

“The vulnerability is still live,” the researcher wrote. “Nobody has ever responded. I guess my email wasn’t in their prayers.”

The app, launched by the pope in 2019, is described as “a digital community of prayer where you can share the intentions of the Holy Father and pray together with others.”

The security flaw, known as an insecure direct object reference, allows anyone to pull user information directly from the app’s website. After signing up and discovering their own user ID listed in a URL, the researcher said they were able to simply “increment the number and get someone else’s data.”

“One of the most basic access control flaws in web security,” the researcher said of the issue. “You ask for your own data, the server gives it to you. You ask for someone else’s data, the server gives you that too.”

Straight Arrow downloaded the Click To Pray app and was able to confirm the flaw after the researcher revealed the name and email address used during sign up.

The Pope’s Worldwide Prayer Network did not respond to an email sent by Straight Arrow on Friday. The cybersecurity news website Dark Reading, which was first to report on the researcher’s findings Friday, said it also did not receive a reply to its inquiry.

The researcher warned that the data, in the hands of a malicious actor, could be used to exploit the app’s users.

“That’s 700,000+ email addresses belonging to people who signed up for an app to pray. A lot of these users are likely older, less tech-savvy, and deeply trusting of anything associated with the Vatican,” the researcher wrote. “A harvested list like this would be a phishing goldmine. Imagine getting an email that says ‘The Holy Father requests your urgent attention’ with a Vatican-looking link. Grandma is clicking that. Every time.”

Round out your reading