Click to Pray App Exposed Personal Data of 719,000 Users Through Unprotected API Endpoint
Security researcher BobDaHacker published a detailed analysis of Click to Pray, the official application of the Pope's Worldwide Prayer Network, revealing a critical authorization flaw. At the time of discovery the service contained 719,517 registered accounts whose numeric IDs were fully sequential and predictable.
The vulnerable endpoint accepted direct requests such as GET https://api.clicktopray.org/user/users/12345 and returned complete profile information without verifying whether the requester was authorized to view the data. Changing the ID to 12346 immediately exposed another user record containing name, surname, email address, country, date of birth, role, and several internal fields. No rate limiting was implemented, allowing systematic enumeration of the entire user base.
The vulnerability is a classic example of Insecure Direct Object Reference (IDOR), also known as Broken Object Level Authorization (BOLA) in the OWASP API Security Top 10. Exploitation required no advanced techniques, only the ability to increment an integer. Additional minor issues included the misspelled field borned_date and the user role value PRAYER.
BobDaHacker first notified nine recipients in January 2026, including the general contact address, six service employees, and two representatives of the Pope's Worldwide Prayer Network. No replies or fixes followed. In July the researcher shared the findings with Dark Reading, whose journalists independently confirmed the exposure and attempted contact with both the network and the development agency La Machi. Again no responses were received.
Following public disclosure on 24 July the endpoint was modified the same day. Requests for other users’ IDs now return only public name and surname fields, while authenticated users can still view their own full records. The researcher learned of the fix through a Reddit comment rather than direct communication.
The incident echoes a 2019 security review of the related Click to Pray eRosary electronic rosary application. At that time researchers from Fidus Information Security found that four-digit PIN codes could be retrieved in plaintext via the sendPIN and resetPIN API calls, enabling immediate account takeover. Those specific issues were addressed after media coverage, yet the underlying pattern of missing authorization checks reappeared years later.
Related articles
Detecting and Removing Secrets from Git History with Betterleaks and git-filter-repo
Developers often accidentally commit sensitive data such as API keys, passwords, database dumps, or private uploads to Git repositories. Even after removal in a later commit, these secrets remain accessible in the commit history and can be recovered by anyone with repository access. The recommended approach begins with scanning the entire history using specialized tools to identify leaked credentials across all branches and past commits. Once identified, the secrets must first be rotated or revoked before any history rewriting occurs. Tools like Betterleaks provide detection with keyword filtering, entropy analysis, and Base64 decoding, while git-filter-repo enables precise removal of files and replacement of secret strings throughout the repository timeline. The process requires careful backups, coordination with teams, and force-pushing rewritten history, followed by fresh clones for all contributors and CI/CD systems. Even after cleanup, organizations must assume that old secrets may persist in forks, backups, or caches and therefore treat rotation as mandatory.
Dropbox Lenovo ID Integration Flaw Exposes Thousands of Accounts Without Passwords
A flaw in the federated authentication process between Dropbox and Lenovo ID allowed attackers to compromise approximately 5,000 accounts between August 4 and August 21, 2026. Attackers registered a Lenovo ID using the email address tied to an existing Dropbox account due to missing email verification checks. They then logged in via the Lenovo ID option, and Dropbox automatically associated the identity with the existing account without requiring the original Dropbox password. Only accounts linked to the Lenovo ID integration and lacking two-factor authentication were affected. In fewer than one-third of the compromised accounts, attackers viewed or downloaded stored files. Dropbox responded by terminating all Lenovo ID sessions, removing existing associations, and updating the login flow to require the Dropbox password. Lenovo described the issue as stemming from a legacy integration and stated that its own customers were not directly impacted.
Yellow Hat Reports Breach in Web Work Reservation System, Possible Leak of 1.8 Million Member Records
Japanese automotive retailer Yellow Hat disclosed that its Web Work Reservation System was compromised, potentially exposing personal data of up to 1,801,499 members. The intrusion was detected on August 18, 2026, after which investigators confirmed that customer information stored on the company's member server may have been exfiltrated. Affected records include names, telephone numbers, email addresses, and member numbers. Yellow Hat has notified law enforcement and Japan's Personal Information Protection Commission while contacting impacted individuals through multiple channels. The company is advising members to remain vigilant against unsolicited communications that could indicate misuse of the stolen data.
Kaspersky MDR Adds Automatic Correlation with Leaked Credentials via Digital Footprint Intelligence
Kaspersky has updated its Managed Detection and Response service to automatically match security events against data from compromised logins and passwords. The enhancement integrates Kaspersky Digital Footprint Intelligence to provide analysts with additional context when suspicious activity coincides with known credential leaks. According to the company, a quarter of attacks investigated in 2025 began with the use of stolen credentials. The update also introduces notifications for asset protection status, allowing administrators to address connectivity or telemetry issues that could affect monitoring quality. Managed service providers can now configure per-client license usage limits, and the service adds support for Kaspersky Embedded Systems Security for Linux 4.0. The MDR platform continues to deliver 24/7 infrastructure monitoring, threat hunting, incident investigation, and response capabilities.