I expect they're using some kind of authentication framework that supports full names in its User entity, and just went with that without considering whether it's sensible.
Looks like you can leave comments on prayers? Could also be that they want a particular aesthetic where everyone has their innate "Christian Name", instead of a username, which is assocated with left wing ideas like digital utopianism. Because...
Real names also enforce a complex of related authoritarian information structures i.e. they provide information about a person's culture, race, gender, which you can use to assign them a place within your religion's moral hierarchy.
the API endpoint GET [redacted] will return user data for any account - not just your own account - so long as you supply a valid, five-digit user ID. It doesn’t perform any authorization check or ownership validation. “Just increment the number and get someone else's data,” she wrote.
This data includes users’ email addresses, first and last names, country, dates of birth, and whether the account has been deleted, and the API exposes all 719,517 accounts on the prayer site. “With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform,” the hacker explained. “One GET request per user. for i in range(1, 719518): scrape(). That's it. That's the exploit.”
My God, that's horrific. Plus it doesn't even delete your data if you delete your account, it's still vulnerable.
I don't know much about GDPR… is it illegal to have badly written software like this? Technically the user is bypassing normal usage and "hacking" the API
Negligence to delete the account data after termination is a reason to be fined.
They don't need to keep that data.
Afaik the only reason would be if MTX were offered (for book-keeping reasons)
They probably meant 6 digit and it was a typo. The rest of the article references 6 digits. If it's just an integer (highly likely) it would go up to 10 digits or roughly 2 billion max users. My old coworkers and I used to joke that hitting INTEGER.MAX_VALUE for your customer ID is a good problem to have
I know, but a lot of people don't click the article, they just look at headline + comments, so it's still a reduction of visibility or an extra step. My comment is like exposing the endpoint right there front and centre. Plus, I don't like being personally responsible for any data breach. Maybe it's just a tiny thing but it felt like the right thing to do
Damn, with that many people praying these prayers are about to get real effective. I'm surprised we haven't heard of their effects and effectiveness yet.
I'd like to see the media mix modeling data to really assess the ROP of these prayers. Cross check that against miracle count and we'll really be cooking.
the Tibetans believe the prayers and mantras will be blown by the wind to spread the good will and compassion into all pervading space. Therefore, prayer flags are thought to bring benefit to all.
By hanging flags in high places the Lung ta will carry the blessings depicted on the flags to all beings. As wind passes over the surface of the flags, which are sensitive to the slightest movement of the wind, the air is purified and sanctified by the mantras.
I choose to believe that the prayer app is just a hip, new and with it innovation in prayer spreading.
The authorization check is there now: request your own user ID and you still get your email back, request someone else's and you get a public profile. Names are supposed to be public on a platform where you pray alongside other people, so what's left is what was always meant to be visible.
As it often is, the source has more information, and significantly so. I also find it much easier and more informative to read. Simple direct speech, headlines, more concrete on what is exposed, more technical details, etc.
They didn't just send one email to report the vulnerability.
and on January 3rd I emailed nine people: the general info address, six individual staff members at clicktopray.org, and two contacts at popesprayer.va (the Pope's Worldwide Prayer Network). No response. From any of them.
For July they have three entries of 'reported to Journalist' ("Dark Reading"), journalist contacted the Pope's Worldwide Prayer Network, and 'still no response'.
They also posted an update about it being fixed on 2026-07-24 that it has been fixed.
The authorization check is there now: request your own user ID and you still get your email back, request someone else's and you get a public profile. Names are supposed to be public on a platform where you pray alongside other people, so what's left is what was always meant to be visible.
I also never got an email. Not an acknowledgment, not a thank you, not a "we've addressed this."
Given that The Register posted this article on 2026-07-24 22 UTC it must have been very unfortunate timing. Presumably they didn't check the source again before pressing publish? And also haven't noticed or bothered to include an information update.
Turns out the biggest miracle wasn’t multiplying loaves, it was making authentication disappear. An IDOR this basic on an app handling personal data is embarrassing. 🙈
70 Comments
thatradomguy@lemmy.world · 144 pts · 25d
"We are gathered here today because your thoughts and prayers did not secure our app"
luthis@lemmy.nz · 116 pts · 25d
Why does it need any personal details at all??
Valmond@lemmy.dbzer0.com · 49 pts · 25d
So that jesus can torture the bad persons.
real_squids@sopuli.xyz · 20 pts · 25d
For sharing between users, as I understand it.
luthis@lemmy.nz · 19 pts · 25d
Username, password is all they need for that. Idiots.
Appoxo@lemmy.dbzer0.com · 5 pts · 25d
But muh statistics :c
msage@programming.dev · 4 pts · 25d
I have 100% attendance god damnit!
jollyrogue@lemmy.ml · 13 pts · 25d
So they know what sins I’ve committed.
They don’t follow my mastodon feed. It’s much easier that way.
tacosanonymous@mander.xyz · 8 pts · 25d
Historically? Abuse.
I’m sure they say it’s for security : blocking bots, etc and getting their newsletter or some shit.
Blackmist@feddit.uk · 5 pts · 25d
They need the list of who's been naughty and who's been nice.
Or is that the other fella?
Tetragrade@leminal.space · 1 pts · 25d
I expect they're using some kind of authentication framework that supports full names in its User entity, and just went with that without considering whether it's sensible.
Looks like you can leave comments on prayers? Could also be that they want a particular aesthetic where everyone has their innate "Christian Name", instead of a username, which is assocated with left wing ideas like digital utopianism. Because...
Real names also enforce a complex of related authoritarian information structures i.e. they provide information about a person's culture, race, gender, which you can use to assign them a place within your religion's moral hierarchy.
Zarobi@aussie.zone · 63 pts · 25d
My God, that's horrific. Plus it doesn't even delete your data if you delete your account, it's still vulnerable.
Appoxo@lemmy.dbzer0.com · 16 pts · 25d
I wonder of the vatican is part of the gdpr...
Would be funny to read about the church getting sued for that.
Zarobi@aussie.zone · 2 pts · 25d
I don't know much about GDPR… is it illegal to have badly written software like this? Technically the user is bypassing normal usage and "hacking" the API
Appoxo@lemmy.dbzer0.com · 13 pts · 25d
Negligence to delete the account data after termination is a reason to be fined.
They don't need to keep that data.
Afaik the only reason would be if MTX were offered (for book-keeping reasons)
xiii@lemmy.world · 7 pts · 25d
It is illegal to keep deleted profiles
needanke@feddit.org · 4 pts · 25d
Yes, especially once you have been informed about it
Zeoic@lemmy.world · 6 pts · 25d
5 digit user ids, yet over 700k users? Im sure they must have gone up to 6 digits
ViatorOmnium@piefed.social · 7 pts · 25d
I tried the endpoint. 5 digits always gives you a valid user, 6 stops working after some point.
Zarobi@aussie.zone · 4 pts · 25d
They probably meant 6 digit and it was a typo. The rest of the article references 6 digits. If it's just an integer (highly likely) it would go up to 10 digits or roughly 2 billion max users. My old coworkers and I used to joke that hitting
INTEGER.MAX_VALUEfor your customer ID is a good problem to haveEarthwormjim91@lemmy.world · 2 pts · 25d
Unless by “digit” they mean any alphanumeric.
You’ve got a lot of options if you go to a 5 characters with letters.
Which they’d kind of have to with 700k users if it’s 5 characters.
If it’s case insensitive, you’ve got 60,000,000+ combinations, and if case sensitive then 916,000,000+ combinations.
ViatorOmnium@piefed.social · 5 pts · 25d
It's numerical only, but the number doesn't need leading 0s so anything from 1 to 6 digits might be a valid user ID.
Earthwormjim91@lemmy.world · 2 pts · 25d
That would be an absolute nightmare to administer lol. Though I guess that tracks.
1, 01, 001, 0001, and 00001 would all be different users
Zeoic@lemmy.world · 1 pts · 25d
Good point, could easily be hex or some higher base
themachinestops@lemmy.dbzer0.com · 5 pts · 25d
It sill works, you get first name and last name.
Zarobi@aussie.zone · 2 pts · 25d
Maybe I should remove that from my comment lol, I feel like I'm contributing to a data breach or something
themachinestops@lemmy.dbzer0.com · 4 pts · 25d
It is in the article doesn't matter if you remove it. The moment the article became public it is already too late.
Zarobi@aussie.zone · 1 pts · 25d
I know, but a lot of people don't click the article, they just look at headline + comments, so it's still a reduction of visibility or an extra step. My comment is like exposing the endpoint right there front and centre. Plus, I don't like being personally responsible for any data breach. Maybe it's just a tiny thing but it felt like the right thing to do
nymnympseudonym@piefed.social · 1 pts · 22d
What's more, scammers now have a list of 750k people known for their gullibility
Gork@sopuli.xyz · 56 pts · 25d
The Catholic Church is known for a lot of things. Keeping up with the times (or cyber security) isn't one of them.
jollyrogue@lemmy.ml · 9 pts · 25d
Cyber security isn’t in the bible. Time for an update.
Cyprus 1:1
…. Copy pasta of NIST security standards circa May 2026 …
Nothing could go wrong with this.
Kissaki@feddit.org · 3 pts · 25d
I thought they were known for keeping things under the rug/hidden. Only priest's not follower's personal data I guess.
username_1@discuss.tchncs.de · 50 pts · 25d
Vatican Programmer: Oh, mighty Lord, sitting in the Sky, show me the way to this bug I seek and eliminate ineffectiveness. Amen.
bitjunkie@lemmy.world · 43 pts · 25d
Still better than vibe coding
real_squids@sopuli.xyz · 14 pts · 25d
The OG vibecoders
Appoxo@lemmy.dbzer0.com · 3 pts · 25d
How so? They are praying for it to work
Axolotl_cpp@feddit.it · 4 pts · 25d
Well, i pray to not have any runtime bug too
ripcord@lemmy.world · 12 pts · 25d
Vatican Programmer: Contractor in India
TheEighthDoctor@lemmy.zip · 2 pts · 25d
Apply the sacred unguents and start the maintenance rites
FartMaster69@lemmy.dbzer0.com · 30 pts · 25d
So uh.. what does a prayer app even do?
real_squids@sopuli.xyz · 21 pts · 25d
The only two screenshots they have on GPlay feature prayer scheduling and sharing your prayer.
Kissaki@feddit.org · 18 pts · 25d
Damn, with that many people praying these prayers are about to get real effective. I'm surprised we haven't heard of their effects and effectiveness yet.
caurvo@aussie.zone · 5 pts · 25d
I'd like to see the media mix modeling data to really assess the ROP of these prayers. Cross check that against miracle count and we'll really be cooking.
jollyrogue@lemmy.ml · 12 pts · 25d
It leaks personal data.
a1studmuffin@aussie.zone · 12 pts · 25d
Press F to pray respects
it_depends_man@lemmy.world · 6 pts · 25d
See, humans are smart. Praying and blessing things yourself? By hand, so to speak? Boooo! Pedestrian! Ain't nobody got time fo dat!
I choose to believe that the prayer app is just a hip, new and with it innovation in prayer spreading.
lena@gregtech.eu · 24 pts · 25d
It still works lmao
No email and some other stuff though.... maybe they just removed that from the endpoint?
hexagonwin@lemmy.today · 9 pts · 25d
lmao did they vibe patch it or smth
Kissaki@feddit.org · 3 pts · 25d
If sinners go to hell, do you even have to do due diligence? Let us pray for the vulnerability to disappear.
Kissaki@feddit.org · 4 pts · 25d
From the source blog post, which has the update
Kissaki@feddit.org · 23 pts · 25d
As it often is, the source has more information, and significantly so. I also find it much easier and more informative to read. Simple direct speech, headlines, more concrete on what is exposed, more technical details, etc.
They didn't just send one email to report the vulnerability.
For July they have three entries of 'reported to Journalist' ("Dark Reading"), journalist contacted the Pope's Worldwide Prayer Network, and 'still no response'.
They also posted an update about it being fixed on 2026-07-24 that it has been fixed.
Given that The Register posted this article on 2026-07-24 22 UTC it must have been very unfortunate timing. Presumably they didn't check the source again before pressing publish? And also haven't noticed or bothered to include an information update.
Soup@lemmy.world · 13 pts · 25d
“Pope sprayer .va” is how I’m choosing to read that.
Kissaki@feddit.org · 7 pts · 25d
CyberChicken@whatcom.social · 20 pts · 25d
Misread it as
jollyrogue@lemmy.ml · 5 pts · 25d
That’s the official Catholic hook up app. It’s different.
Actually….
JasonDJ@lemmy.zip · 2 pts · 25d
I thought that was Roblox?
spacehulk@lemmy.zip · 18 pts · 25d
Why not just give the app away and let people access the content without having them sign up? Oh right.... The people are the product.
expatriado@lemmy.world · 13 pts · 25d
a pope app? perfect for indulgence micro transactions
real_squids@sopuli.xyz · 4 pts · 25d
I think they patched that one a while ago
Martineski@lemmy.dbzer0.com · 12 pts · 25d
There's a fucking official app for prayers?!
jollyrogue@lemmy.ml · 8 pts · 25d
Was this vibe coded?
That would be rather ironic.
CubitOom@infosec.pub · 6 pts · 25d
Is JD Vance in here? He's supposed to be Catholic right?
Valmond@lemmy.dbzer0.com · 6 pts · 25d
Alcoholic, not Catholic!
CubitOom@infosec.pub · 4 pts · 25d
One can be both.
JD Vance, once an ‘angry atheist’, is America’s most powerful Catholic. How will he wield his faith?
Valmond@lemmy.dbzer0.com · 2 pts · 25d
That's because religion attracts perverts and con men.
AllNewTypeFace@leminal.space · 6 pts · 25d
To borrow a tenet from another abrahamic religion, trust in God, but tie up your camel.
CriticalMiss@lemmy.world · 5 pts · 25d
Why should they care about security user data? We’re all equal before God.
magnetosphere@fedia.io · 4 pts · 25d
I’ve seen so many stories about leaks that I skip most of them. I’m glad I didn’t skip this one.
phillycodehound@lemmy.world · 3 pts · 25d
Wow not a good look.
eicker@lemmy.world · 2 pts · 25d
Turns out the biggest miracle wasn’t multiplying loaves, it was making authentication disappear. An IDOR this basic on an app handling personal data is embarrassing. 🙈
Blackfeathr@lemmy.world · 1 pts · 25d