🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: bobdahacker.com/blog/click-to-…

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails

How I found that anyone can pull the email address, name, country, and date of birth of any of the 719,517 users on Click To Pray, the Pope's official prayer app, with a single GET request. Reported January 3rd. Still live six months later.

^{bobdahacker.com}

EXCOMMUNITCATED!

Good riddance to those freaks, good for Pope Leo for making a stand against the fascists in the Church (there's quite a few)

Y'know, Science good do with chucking out the Fascists....looking at you Royal Society..

theguardian.com/world/2026/jul…

#PopeLeoXIV #Vatican #Catholicism #Fascism #SSPX

Vatican excommunicates all members of ultra-conservative rebel group SSPX

Schism caused by Society of Saint Pius X ordaining four bishops without consent presents first crisis for Pope Leo

^{Angela Giuffrida (The Guardian)}