vatican

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

Email addresses
Names
Country
Date of birth (they call it "borned_date" lol)
Account role (it's "PRAYER" for everyone, obviously)

Also found:

Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

#PopeLeo XIV made a historic #apology Monday for the role the Holy See played in #slavery & for having failed to condemn it for centuries, calling the #Vatican’s record a “wound in Christian memory.”

Past popes have apologized for Christians’ involvement in the trans-Atlantic slave trade. But no pope had ever publicly acknowledged, much less apologized for, the role that past popes played in giving European sovereigns explicit authority to subjugate & enslave “infidels.”
https://apnews.com/article/pope-apologizes-slavery-role-holy-see-vatican-78df993c5604eb098b19f255b89b3155