Loading story…
The Vatican-affiliated Click to Pray website and mobile app exposed personal data for more than 700,000 users through an insecure direct object reference (IDOR) vulnerability in a publicly accessible API endpoint. Reports said anyone with a browser could enumerate sequential user IDs and retrieve plaintext account details without authorization, affecting roughly 719,517 accounts tied to the Pope’s Worldwide Prayer Network, including staff and administrative users. Exposed information included names, email addresses, country codes, dates of birth, account deletion status, and indicators showing whether an account had administrative privileges.
Researcher BobDaHacker said the flaw was reported on January 3 and remained live for at least six months, with independent verification indicating it was still exposed at publication. Additional reporting said the app’s sign-up process returned the validation_hash used for email verification, allowing attackers to validate accounts for arbitrary email addresses before legitimate users received the message, while official verification emails reportedly failed domain authentication checks. The platform, owned by the Pope’s Worldwide Prayer Network and developed by La Machi Communication for Good Causes, now faces heightened risk of phishing and social-engineering attacks impersonating Vatican-linked organizations.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Tom's Hardware reported that after Dark Reading sought comment and published its story, the Click To Pray app's exposed API and related security issues were reportedly remediated. This marks the first reported fix after more than six months of unresolved exposure.
Reporting revealed that the platform's sign-up endpoint returned the validation_hash used for email verification, allowing attackers to verify accounts tied to arbitrary email addresses before legitimate recipients received the message. The same report said Click To Pray verification emails failed domain authentication checks, increasing phishing risk.
At the time of publication, the Click To Pray API still exposed personal data from more than 700,000 accounts, including names, email addresses, country information, and account status, through unauthenticated enumeration of sequential user IDs. Reporting also noted exposure affecting staff and administrative accounts tied to the Pope’s Worldwide Prayer Network.
A researcher identified and reported an insecure direct object reference vulnerability in the Vatican-affiliated Click To Pray platform. According to the report, the issue was disclosed on January 3 but remained unresolved for months.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcecysecurity.news
Open sourcecybersecuritynews.com
Open sourcetomshardware.com
Open sourcescworld.com
Open sourcedarkreading.com
Open sourcebobdahacker.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
VentureEd Solutions fixed a vulnerability in *Ravenna Hub*, a student admissions and application-tracking platform used across thousands of schools, after it was found to expose sensitive information about children and their families. The issue was an **insecure direct object reference (IDOR)** that allowed any authenticated user to access other users’ records by modifying sequential student identifiers in the URL, enabling access to data beyond their own account. Exposed information included children’s **names, dates of birth, home addresses, photos, and school details**, along with parents’ **email addresses and phone numbers** and information about siblings. VentureEd’s CEO said the company was able to reproduce the issue and remediated it after being alerted, but the company did not clearly commit to user notification and did not confirm whether it can determine if improper access occurred; it also declined to provide details on third-party security testing or internal cybersecurity oversight.
Jun 29, 2026
ShinyHunters publicly leaked data from **Moody Bible Institute** after a "pay or leak" extortion attempt, exposing more than **2.3 million unique email addresses** along with names, physical addresses, phone numbers, dates of birth, and other personal details tied to donors, supporters, students, and alumni. Moody said it brought in internal and external cybersecurity specialists to investigate the breach and respond to the disclosure. The same threat activity has also been linked to attacks on **Oracle PeopleSoft** deployments, with the **National Association of Insurance Commissioners (NAIC)** saying attackers exploited a **zero-day** flaw to gain temporary access to part of its IT environment and steal confidential financial reporting, credit rating agency, and technical data that was later published online. NAIC said the intrusion was part of a broader campaign affecting multiple organizations after ShinyHunters claimed compromises of more than 100 PeopleSoft installations worldwide; the organization said no personally identifiable information or payment account data was involved, remediated affected systems with outside experts, and said the **FBI** was investigating.
Jul 10, 2026
Cybernews researchers reported multiple **data exposures caused by misconfigured back-end services**, including consumer mobile apps and a large unprotected database. Three widely downloaded Android AI photo identification apps—*Insect Identifier by Photo Cam*, *Dog Breed Identifier Photo Cam*, and *Spider Identifier App by Photo*—reportedly leaked more than **150,000** users’ data via a **Firebase misconfiguration** with inadequate authentication/access controls. Exposed data included email addresses, usernames, profile photos, notification tokens, and **GPS coordinates**; while passwords were not found, researchers noted the location data could enable stalking, doxxing, and targeted scams, and observed indications that automated bots had already discovered the exposed databases prior to the investigation. The apps were attributed to publisher **MobilMinds** (linked to **OZI Technologies**), and the developers reportedly did not respond to requests for comment. Separately, Cybernews identified an **unprotected Elasticsearch cluster** exposing approximately **8.7 billion records** associated with China, including names, birthdates, home addresses, national ID numbers, social media identifiers, usernames, and other account/platform details; the dataset also reportedly contained **plaintext credentials** and corporate/business records, suggesting long-term aggregation. The database’s ownership was not confirmed, but it was subsequently secured; researchers characterized the exposure as a systemic privacy risk potentially affecting hundreds of millions of individuals. Two additional items in the set describe individual bug-hunting writeups (e.g., bypassing mobile controls and abusing password reset/IDOR-style issues) but do not provide verifiable linkage to the specific Firebase/Elasticsearch exposures described above.
Jun 29, 2026