Anyone With a Browser Could Access 700,000 Vatican Prayer App Accounts

A critical IDOR (insecure direct object reference) vulnerability in the Vatican’s Click to Pray web and mobile platforms allowed unauthenticated enumeration of sequential user IDs, exposing PII for more than 700,000 users — including full names, emails, country identifiers, account status, and privilege levels (notably staff/admin accounts). The flaw enabled trivial mass data harvesting and would facilitate highly targeted phishing or impersonation campaigns; attempts to coordinate remediation were reportedly unsuccessful at the time of reporting.