Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Phishing Risk. Show all posts
Vatican Click To Pray App
API Security Vulnerability Broken Access Control Click To Pray Security Flaw Cyber Security IDOR vulnerability Phishing Risk User Data Exposure Vatican App Data Leak Vatican Click To Pray App

Vatican ‘Click to Pray’ App Security Flaw Exposed Data of 700,000 Users


Approximately 700,000 personal data of Vatican users were reportedly exposed due to a critical security vulnerability in Click to Pray, causing concerns about data privacy and phishing. An independent security researcher BobDaHacker discovered in January 2026 that the backend API lacked basic authentication and access controls, leading to the discovery of the flaw. 

Researchers indicate that anyone could retrieve user information by simply altering sequential user ID numbers in API requests, thereby making sensitive data publicly accessible without authorization. It has been identified as an Insecure Direct Object Reference (IDOR) flaw, a type of access control weakness that can allow unauthorized users to manipulate object identifiers in order to gain access to restricted data. 

Using the exposed API endpoint, the researcher reported that no authentication was required, thus anybody with knowledge of the endpoint could access user records directly through a web browser, without requiring advanced technical knowledge. The information exposed was reported to include first and last names, email addresses, dates of birth, preferred language, and account information. However, cybersecurity experts caution that, even though financial information was not disclosed, email addresses combined with personal information can significantly increase the risk of targeted phishing scams and social engineering attacks. 

Additionally, the exposed records revealed the country of origin of each user, his account status, and the level of privileges he or she possessed, including whether the account belongs to an administrator or a regular user. Research findings identified that the platform's staff accounts were among the lowest-numbered user IDs, which made internal accounts accessible via the same vulnerable API. Other security flaws were also identified by the researcher. 

By assigning sequential user IDs to newly created accounts, automated requests were able to access the entire user database. Additionally, the API did not contain rate limits, which allowed attackers to collect a large number of user records without restrictions. Additionally, the validation hash used to verify emails was stored in plain text, thus providing another potential attack vector. 

Further, the researchers indicated that the vulnerable endpoint could be exploited without specialized tools, since user IDs were assigned sequentially. This allowed attackers to automate requests to enumerate the database and gather user information at a large scale. Due to the absence of authorization checks, the vulnerability represents a fundamental failure in access control rather than a sophisticated attack. 

In accordance with the disclosure, the researcher attempted to inform multiple contacts related to the application of the vulnerabilities immediately after discovery. However, despite several requests for responses, the issues were not resolved for nearly six months. Security journalist Nate Nelson of Dark Reading also contacted the developers, but did not receive a response. 

The vulnerability was independently tested prior to publication by cybersecurity publication Dark Reading. As stated in the publication, the Pope's Worldwide Prayer Network, which operates the platform, as well as La Machi Communication for Good Causes, the agency responsible for developing the application, were also contacted, but no response was received before the issue became public. 

According to the researcher, the vulnerabilities were addressed only after they were made public through media coverage. Although the researcher followed responsible disclosure practices, no formal acknowledgement was provided for the vulnerabilities. There are reportedly nearly 720,000 registered accounts on Click to Pray by July 2026, making the exposure significant despite the app's niche target audience. 

According to researchers, many faith-based application users might not be aware of cybersecurity threats, thus making them attractive targets for online scams and phishing attacks. As a result of this incident, fundamental API security measures such as authentication, authorization, rate limiting, and safe handling of sensitive information need to be implemented. Furthermore, the incident emphasizes the importance of maintaining effective vulnerability disclosure programs and responding promptly when security researchers uncover security flaws. 

Security experts point out that the incident highlights one of the most common vulnerabilities in application security. There is no doubt that broken access control is one of the most critical risks in OWASP's Top 10. Issues with IDOR vulnerabilities persist across organizations of all sizes when developers implement authentication procedures without properly enforcing authorization procedures. 

Organizations collecting personal information, including commercial businesses, nonprofit organizations, and religious institutions, should implement robust security controls and maintain effective vulnerability disclosure processes as a result of this incident. Keeping user information secure is an integral part of every organization that has been given personal information.

Click to Pray illustrates that no organization is exempt from cybersecurity risks. Using strong access controls, secure API practices, and responding to vulnerabilities promptly remain essential for protecting user data and maintaining public trust in digital platforms.
Read more »
Vendor Risk Management
Data Breach Email Service Provider Incident response Phishing Risk SaaS security supply chain security Third-party breach User Data Protection Vendor Risk Management

Flickr Reveals Data Breach Originating From Third Party Systems


 

A security incident affecting the user data of popular photo sharing platform Flickr has been confirmed to be the result of a compromise within a third-party service integrated into Flickr's operation, rather than the company's core infrastructure. 

According to the company, sensitive customer information was exposed through a breach involving an external email service provider, which exposed an undisclosed number of users' sensitive data. In spite of Flickr's emphasis on the fact that the intrusion was detected and contained within hours, the incident illustrates the persisting risks associated with third-party dependencies within modern cloud and SaaS environments. 

An unauthorized access was discovered on February 5, which resulted in immediate incident response measures as indicated in a breach notification circulated to affected users and reviewed by The Register. 

An external provider's vulnerable endpoint was identified as a source of malicious activity by Flickr, which was immediately isolated in order to prevent further data exposure or lateral movement. In addition to revocation of pathways and expulsion of threat actors, notifications were also sent to the relevant regulatory authorities, data protection bodies, and affected customers regarding the malicious activity. 

A thorough forensic investigation has been commissioned by the company's third-party provider, and detailed findings will be shared as soon as possible, signaling the company's commitment to reviewing vendor security controls and accountability in a broader way. 

Following notification to users, the incident disclosure indicates that Flickr's exposure was caused by a security breach within an external email service provider it uses rather than a compromise of its primary platform itself. 

Among the information that could potentially have been accessed by unauthorized parties were real names, email addresses, IP addresses, and limited account activity information. Flickr declined to identify the third-party provider involved in the incident and did not specify how many users may have been affected, merely stating that investigation continues to determine the scope of the impact. 

Since Flickr's founding in 2004, it has grown into one of the world's largest communities of photographers, hosting over 28 billion photos and videos, and reporting a monthly active user base of over 35 million users, with over 800 million page views. 

The company stated in its statement that immediate containment measures were initiated following the detection of the issue. These measures included revoking access to the affected systems, severing connections with the vulnerable endpoints, and engaging a third-party provider to conduct an extensive forensic examination.

In parallel with these actions, Flickr notified relevant data protection authorities and initiated an internal security assessment intended to strengthen governance and technical controls across third-party integrations.

In its user advisory, Flickr urged customers to be aware of potential phishing attempts that may impersonate official communications in order to exploit this incident. As part of the company's recommendations, the company also recommended that customers review their account activity for anomalies and update their credentials on other services in cases where they may have been reused, reinforcing the importance of standard post-breach hygiene practices during the investigation process. 

As part of its notification to users, Flickr indicated that they are conducting an in-depth investigation as well as reinforcing the security controls governing third-party providers, and that the relevant data protection authorities have been formally notified. 

It was clarified by the company that the attackers accessed a variety of information based on the user, such as name, email address, username, account types, IP addresses, and approximate location information. 

In light of the incident, Flickr stressed that passwords, payment information, and other financial information were not compromised. Specifically, the company cautioned users to be on their guard when receiving suspicious e-mails, particularly messages that purport to be from the company, as the exposed personally identifiable information could be utilized to develop convincing social engineering attacks. 

Additionally, the notification included references to European and United States data protection authorities, which suggests that the incident may have affected users in more than one jurisdiction. With over 35 million monthly users across 190 countries, Flickr has a global exposure spanning a wide geographical area. 

Neither the threat actor nor the data had surfaced on known underground marketplaces at the time of disclosure. However, security experts note that even limited account metadata may be exploited in order to stage targeted phishing attempts, such as fraudulent account suspension notices or payment verification requests, aimed at obtaining additional credentials or financial information from users without their knowledge.

It is important to remember that third-party integrations, particularly those embedded in identity, communication, and notification workflows, create an expanding attack surface. Even though the immediate impact of Flickr's breach was limited by its rapid containment, the incident demonstrates the importance of continuous risk assessments and endpoint visibility among external service providers, as well as contractual security obligations. 

Increasingly, organizations operating at a global scale must regard third-party services as extensions of their internal environment, subject to the same monitoring, logging, and incident response procedures as they do their internal systems. 

A user may be exposed to long-term risks associated with the misuse of seemingly low-sensitivity account information, which can later be repurposed to facilitate highly targeted phishing and account takeover attempts. 

According to security professionals, it is advisable to maintain separate credentials across different services, to enable additional authentication safeguards when they are available, and to exercise caution when responding to unsolicited communication regarding users' account.

During the course of the investigation, the broader industry will closely observe for any further disclosures that may affect how platform operators balance their reliance on external vendors with demonstrating an effective supply-chain security infrastructure.
Read more »
Subscribe to: Posts (Atom)