Vatican Click to Pray API Flaw Exposes 700K Users

The report details an Insecure Direct Object Reference (IDOR) in the Vatican's Click to Pray API that reportedly allowed unauthenticated access to potentially more than 700,000 user records (first/last names, email addresses, country identifiers, account status and roles); it covers discovery by an ethical hacker, independent verification, the technical root cause (broken access control), the likely risks (targeted phishing, credential stuffing, impersonation, reputational and regulatory impact), and prescribes remediation such as enforcing object-level authorization, API security testing, MFA, and monitoring.