Vatican Prayer App Exposes 700K Users' Personal Data via Unprotected API
A vulnerable API in the Vatican’s Click‑to‑Pray app let anyone enumerate over 700,000 users, revealing names, emails, country and staff status. The IDOR flaw required no authentication, exposing global worshippers’ PII and raising concerns for a religious organization’s data hygiene.