Vatican prayer app left personal data of 700,000 users exposed

Researchers found that an official Vatican prayer app exposed the personal information of more than 700,000 users worldwide through an insecure configuration. The exposed data included details that can identify individuals and tie them to their use of the app. Faith and health apps are sensitive because the mere fact of using them can be revealing, and religious affiliation is a protected category in many jurisdictions, so even a modest data set carries outsized risk for the people in it. The exposure stemmed from the way the app's backend was set up rather than a sophisticated intrusion, a recurring pattern in mobile app data leaks where access controls are misconfigured.

Check

App developers should review backend access controls and confirm that user data stores require authentication and are not readable by anyone who can reach the endpoint.

Affected

More than 700,000 users of the Vatican prayer app whose personal information was exposed; because the data links people to a religious app, it is sensitive even where individual fields seem limited.

Fix

Developers should enforce authentication on all data endpoints, apply least privilege to backend stores, test for misconfiguration before release, and minimize the personal data collected by faith and health apps.