Unprotected API Endpoint Exposes 700K+ Vatican App Users' PII
The Vatican's official prayer app exposed personally identifiable information for over 700,000 users due to an API endpoint that required no authentication, meaning anyone with a browser could freely access sensitive data. This is a classic misconfigured API vulnerability — a growing attack surface as mobile and web applications increasingly rely on APIs to serve data. The exposed data (names, emails, location, account status) creates real risk for phishing, targeted scams, and religious profiling of users across the globe. The breach underscores that even mission-driven, non-commercial organizations must apply rigorous security controls to any internet-facing service handling personal data.
Tactical Insight
Immediate actions
- Audit all API endpoints immediately to verify that authentication and authorization controls are enforced before any data is returned.
- Disable or firewall any publicly accessible endpoint that is not explicitly required to be public-facing.
Long-term improvements
- Implement an API gateway with mandatory OAuth 2.0 or API key authentication for every endpoint that handles user data.
- Establish a formal API inventory and include API security testing (e.g., OWASP API Security Top 10) as a required phase in the software development lifecycle.
- Adopt a data minimization policy so that API responses only return the fields strictly necessary for the requesting function.
Detection measures
- Deploy continuous API traffic monitoring to alert on anomalous bulk data retrieval or unauthenticated access patterns.
- Schedule regular third-party penetration tests and automated DAST scans specifically targeting API endpoints before each major release.