Researchers indicate that anyone could retrieve user information by simply altering sequential user ID numbers in API requests, thereby making sensitive data publicly accessible without authorization. It has been identified as an Insecure Direct Object Reference (IDOR) flaw, a type of access control weakness that can allow unauthorized users to manipulate object identifiers in order to gain access to restricted data. 

Using the exposed API endpoint, the researcher reported that no authentication was required, thus anybody with knowledge of the endpoint could access user records directly through a web browser, without requiring advanced technical knowledge. The information exposed was reported to include first and last names, email addresses, dates of birth, preferred language, and account information. However, cybersecurity experts caution that, even though financial information was not disclosed, email addresses combined with personal information can significantly increase the risk of targeted phishing scams and social engineering attacks. 

Additionally, the exposed records revealed the country of origin of each user, his account status, and the level of privileges he or she possessed, including whether the account belongs to an administrator or a regular user. Research findings identified that the platform's staff accounts were among the lowest-numbered user IDs, which made internal accounts accessible via the same vulnerable API. Other security flaws were also identified by the researcher. 

By assigning sequential user IDs to newly created accounts, automated requests were able to access the entire user database. Additionally, the API did not contain rate limits, which allowed attackers to collect a large number of user records without restrictions. Additionally, the validation hash used to verify emails was stored in plain text, thus providing another potential attack vector. 

Further, the researchers indicated that the vulnerable endpoint could be exploited without specialized tools, since user IDs were assigned sequentially. This allowed attackers to automate requests to enumerate the database and gather user information at a large scale. Due to the absence of authorization checks, the vulnerability represents a fundamental failure in access control rather than a sophisticated attack. 

In accordance with the disclosure, the researcher attempted to inform multiple contacts related to the application of the vulnerabilities immediately after discovery. However, despite several requests for responses, the issues were not resolved for nearly six months. Security journalist Nate Nelson of Dark Reading also contacted the developers, but did not receive a response. 

The vulnerability was independently tested prior to publication by cybersecurity publication Dark Reading. As stated in the publication, the Pope's Worldwide Prayer Network, which operates the platform, as well as La Machi Communication for Good Causes, the agency responsible for developing the application, were also contacted, but no response was received before the issue became public. 

According to the researcher, the vulnerabilities were addressed only after they were made public through media coverage. Although the researcher followed responsible disclosure practices, no formal acknowledgement was provided for the vulnerabilities. There are reportedly nearly 720,000 registered accounts on Click to Pray by July 2026, making the exposure significant despite the app's niche target audience. 

According to researchers, many faith-based application users might not be aware of cybersecurity threats, thus making them attractive targets for online scams and phishing attacks. As a result of this incident, fundamental API security measures such as authentication, authorization, rate limiting, and safe handling of sensitive information need to be implemented. Furthermore, the incident emphasizes the importance of maintaining effective vulnerability disclosure programs and responding promptly when security researchers uncover security flaws. 

Security experts point out that the incident highlights one of the most common vulnerabilities in application security. There is no doubt that broken access control is one of the most critical risks in OWASP's Top 10. Issues with IDOR vulnerabilities persist across organizations of all sizes when developers implement authentication procedures without properly enforcing authorization procedures. 

Organizations collecting personal information, including commercial businesses, nonprofit organizations, and religious institutions, should implement robust security controls and maintain effective vulnerability disclosure processes as a result of this incident. Keeping user information secure is an integral part of every organization that has been given personal information.

Click to Pray illustrates that no organization is exempt from cybersecurity risks. Using strong access controls, secure API practices, and responding to vulnerabilities promptly remain essential for protecting user data and maintaining public trust in digital platforms.