Vatican’s Click to Pray App Exposes 700,000 Users Through Unauthenticated API Flaw

## Executive summary An IDOR vulnerability in the Click to Pray application's unauthenticated API exposed personal records for roughly 700,000+ users (names, emails, passwords, country and roles), enabling bulk harvesting and increasing risk of targeted phishing and impersonation; the report describes discovery, testing, and mitigation recommendations and includes the ClicktoPray domain as an IoC.