Pope’s prayer app leaks 700,000 user emails

The Click To Pray app, endorsed by the Pope and used by hundreds of thousands worldwide, was leaking user names and email addresses for months. An ethical hacker discovered the vulnerability six months ago and reported it, but received no response, as first reported by The Register.

The security flaw, identified by ethical hacker BobDaHacker, stems from an Insecure Direct Object Reference (IDOR) bug. This allows anyone to access user data by simply incrementing a sequential user ID. The API endpoint GET https://api[.]clicktopray.org/user/users/{id} was found to return data for any account, not just the user's own. This exposed the personal information of all 719,517 registered accounts, including names, email addresses, countries, and dates of birth. The hacker noted that the lack of rate limiting means an attacker could easily scrape all user data. Furthermore, the signup endpoint returns a validation hash, allowing for account verification with any email address. This vulnerability creates a significant phishing risk, especially for less tech-savvy users who trust Vatican-related communications. The app's own verification emails also reportedly have authentication issues, making them appear similar to phishing attempts.

Source: The Register