posted in Technology
Pope's official prayer app commits cardinal sin, leaks 700K+ users' info
www.theregister.com/security/2026/07/24/popes-official-prayer-app-commits-cardinal-sin-leaks-700k-users-info/5278603
theregisterPope's official prayer app commits cardinal sin, leaks 700K+ users' info(Security) hole-ier than thouReplying to @stermy4u@lemmy.world
the API endpoint GET
[redacted]will return user data for any account - not just your own account - so long as you supply a valid, five-digit user ID. It doesn’t perform any authorization check or ownership validation. “Just increment the number and get someone else’s data,” she wrote.This data includes users’ email addresses, first and last names, country, dates of birth, and whether the account has been deleted, and the API exposes all 719,517 accounts on the prayer site. “With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform,” the hacker explained. “One GET request per user. for i in range(1, 719518): scrape(). That’s it. That’s the exploit.”
My God, that’s horrific. Plus it doesn’t even delete your data if you delete your account, it’s still vulnerable.
Replying to @Zarobi@aussie.zone
5 digit user ids, yet over 700k users? Im sure they must have gone up to 6 digits
Replying to @Zeoic@lemmy.world
They probably meant 6 digit and it was a typo. The rest of the article references 6 digits. If it’s just an integer (highly likely) it would go up to 10 digits or roughly 2 billion max users. My old coworkers and I used to joke that hitting INTEGER.MAX_VALUE for your customer ID is a good problem to have
Replying to @Zeoic@lemmy.world
Unless by “digit” they mean any alphanumeric.
You’ve got a lot of options if you go to a 5 characters with letters.
Which they’d kind of have to with 700k users if it’s 5 characters.
If it’s case insensitive, you’ve got 60,000,000+ combinations, and if case sensitive then 916,000,000+ combinations.
Replying to @Earthwormjim91@lemmy.world
Good point, could easily be hex or some higher base
It’s numerical only, but the number doesn’t need leading 0s so anything from 1 to 6 digits might be a valid user ID.
Replying to @ViatorOmnium@piefed.social
That would be an absolute nightmare to administer lol. Though I guess that tracks.
1, 01, 001, 0001, and 00001 would all be different users
I tried the endpoint. 5 digits always gives you a valid user, 6 stops working after some point.
Replying to @Zarobi@aussie.zone
It sill works, you get first name and last name.
Replying to @themachinestops@lemmy.dbzer0.com
Maybe I should remove that from my comment lol, I feel like I’m contributing to a data breach or something
Replying to @Zarobi@aussie.zone
It is in the article doesn’t matter if you remove it. The moment the article became public it is already too late.
Replying to @themachinestops@lemmy.dbzer0.com
I know, but a lot of people don’t click the article, they just look at headline + comments, so it’s still a reduction of visibility or an extra step. My comment is like exposing the endpoint right there front and centre. Plus, I don’t like being personally responsible for any data breach. Maybe it’s just a tiny thing but it felt like the right thing to do
Replying to @Zarobi@aussie.zone
I wonder of the vatican is part of the gdpr…
Would be funny to read about the church getting sued for that.
Replying to @Appoxo@lemmy.dbzer0.com
I don’t know much about GDPR… is it illegal to have badly written software like this? Technically the user is bypassing normal usage and “hacking” the API
Replying to @Zarobi@aussie.zone
Yes, especially once you have been informed about it
Replying to @Zarobi@aussie.zone
It is illegal to keep deleted profiles
Replying to @Zarobi@aussie.zone
Negligence to delete the account data after termination is a reason to be fined.
They don’t need to keep that data.
Afaik the only reason would be if MTX were offered (for book-keeping reasons)
What’s more, scammers now have a list of 750k people known for their gullibility