Security flaw in Vatican’s ‘Click to Pray’ app leaves over 700,000 global users exposed — app has been leaking user data for over six months and still does

https://www.tomshardware.com/author/jowi-morales· Jul 25, 2026 · 5:56 PM UTC ·9 min read · 0 reactions · 0 comments · 16 views

#security #flaw #vatican #click #pray

TL;DR · WeSearch summary

Tech Industry Cybersecurity Security flaw in Vatican’s ‘Click to Pray’ app leaves over 700,000 global users exposed — app has been leaking user data for over six months and still does News By Jowi Morales Published 25 July 2026 Were the app's developers relying on divine authentication? When you purchase through links on our site, we may earn an affiliate commission. According to BobDaHacker, they discovered in January 2026 that the Vatican-linked app had zero security, allowing anyone to access user data through the API endpoint by simply typing in user IDs.

Key facts

▪Tech Industry Cybersecurity Security flaw in Vatican’s ‘Click to Pray’ app leaves over 700,000 global users exposed — app has been leaking user data for over six months and still does News By Jowi Morales Published 25 July 2026 Were the app
▪When you purchase through links on our site, we may earn an affiliate commission.
▪According to BobDaHacker, they discovered in January 2026 that the Vatican-linked app had zero security, allowing anyone to access user data through the API endpoint by simply typing in user IDs.

About this source

Tom's Hardware files mainly under tech. We currently carry 430 of its stories.

All Tom's Hardware coverage →

Original article

Tom's Hardware · https://www.tomshardware.com/author/jowi-morales

Read full at Tom's Hardware →

Story provenance

Source · retrieval · rights · ranking — open for full record

inspect →

Attribution is not the same as permission. This drawer separates discovery metadata, excerpts, WeSearch-generated summaries, reuse status, and whether the publisher receives the visit. Nothing here claims a legal grant the publisher has not made.

Record

Original publisher	Tom's Hardware
Canonical URL	https://www.tomshardware.com/tech-industry/cyber-security/security-flaw-in-vaticans-click-to-pray-app-leaves-over-700-000-global-users-exposed-app-has-been-leaking-user-data-for-over-six-months-and-still-does
Publication time	Sat, 25 Jul 2026 17:56:07 +0000
Retrieval time	2026-07-25T18:02:19.694Z
Last seen	2026-07-25T18:02:19.694Z
Headline source	Publisher (no WeSearch rewrite)
Excerpt source	publisher body
Excerpt method	First ~120 words (~800 chars) of extracted publisher body, fair-use limited.
Summary	WeSearch · cerebras-chat (WeSearch summarizer)
Summary source text	contentText
Citation coverage	Summary is a WeSearch-generated derivative; primary citation is the original publisher URL.
Cluster	3LYS0T91XYkB
Cluster logic	Grouped by semantic title/content similarity across sources within a rolling window. Same-publisher template collisions are excluded from coverage comparison.
Ranking reason	Story pages are not engagement-ranked. Hub feeds use recency, with optional source-diversified chronological ordering (cap consecutive stories per source). No personalized ranking.
Publisher visit	Yes — open original
Substitutes article?	No — link-out required for full text

Rights status (four layers)

Publisher-declared

No publisher-confirmed rights record for this source yet.

Machine-readable

No source-specific machine-readable restriction detected beyond the public feed.

WeSearch interpretation

WeSearch declared handling (basis: Derived from the published RSS/Atom feed). This is WeSearch policy, not a legal grant on the publisher's behalf.

Unknown

Retrieval and training permissions are not asserted unless the publisher confirms them.

WeSearch handling by dimension

Indexing	May the item be indexed (stored, ranked, made findable)?	Allowed
Snippet	May a short excerpt of the publisher's text be shown?	Allowed
AI summary	May WeSearch generate its own short summary of the article?	Limited
Retrieval / RAG	May the content be exposed for third-party retrieval-augmented generation?	Not asserted
Model training	May the content be used to train AI models?	Not asserted
Commercial reuse	May the content be reused commercially?	Not permitted

Basis: Derived from the published RSS/Atom feed. Contact: [email protected]. Reviewed: 2026-07-24.

Open original publisher → Source rights JSON → Machine-readable provenance → Rights framework → WESEARCH-STORY-PROVENANCE-V1

Opening excerpt (first ~120 words) tap to expand

Tech Industry Cybersecurity Security flaw in Vatican’s ‘Click to Pray’ app leaves over 700,000 global users exposed — app has been leaking user data for over six months and still does News By Jowi Morales Published 25 July 2026 Were the app's developers relying on divine authentication? When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works. (Image credit: Getty Images) Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Click To Pray, the official prayer app of the Pope’s Worldwide Prayer Network, was found to have zero security by a security researcher.

…

Excerpt limited to ~120 words for fair-use compliance. The full article is at Tom's Hardware.

Anonymous · no account needed

Discussion

0 comments