Insecure Direct Object Reference (IDOR) in Vatican’s “Click To Pray” App Exposes Personal Data of 700 K Users
What Happened — An API endpoint in the Vatican‑endorsed Click To Pray mobile app allowed any requester to retrieve the full profile of any registered user by simply iterating sequential numeric IDs. The flaw also returned the email‑verification hash, enabling account takeover. The issue was disclosed in January 2026 and patched six months later.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a gap in SOC 2 CC6 – Confidentiality and CC5 – Privacy controls: lack of proper authorization checks on data‑access APIs.
- Highlights the need for continuous control monitoring and evidence that access‑control logic is enforced, a core requirement for a defensible SOC 2 audit trail.
- Aligns with Verisq’s Control Mapping capability, which helps organizations map API‑level security controls to SOC 2 criteria and collect ongoing evidence of remediation.
Who Is Affected – Religious‑non‑profit organizations, mobile‑app providers, and any entity exposing personal data through poorly‑guarded APIs.
Recommended Actions
- Map the API authorization failure to SOC 2 CC6/CC5 controls and document the remediation as audit evidence.
- Implement strict access‑control checks (role‑based, token‑based) on all API endpoints that return PII.
- Rotate and invalidate all previously issued validation hashes; enforce one‑time use.
- Conduct a privacy impact assessment (PIA) and update your data‑retention policy.
- Deploy continuous API‑security monitoring to detect future IDOR‑type anomalies.
Source: Malwarebytes Labs
Technical Notes – The flaw is an Insecure Direct Object Reference (IDOR) where user IDs were sequential integers (1‑719,517). The API returned email, full name, country, and date of birth without verifying the requester’s entitlement. A secondary issue exposed the email‑verification hash in the response payload. No CVE was assigned; the vulnerability resides in custom API logic.