Is it legal to fly over Vatican City?
Yes, it is legal to fly above Vatican City, but not below 2500 FT if flying IFR or 3500 FT if flying VFR.
There are several Prohibited Areas established over Rome. Prohibited area 212, mentioned by @JanHudec, is not actually above Vatican City, instead it is there to protect the Regina caeli prison.
However, there is a prohibited area covering the Vatican City: P243, in which IFR traffic is prohibited below 2500 FT and VFR traffic is prohibited below 3500 FT. The AIP (ENR 5.1.1-14) notes that the area is &quot;subject to overflyng restriction for security-safety reasons&quot;. While not mentioned directly in the AIP, presumably, there is a way to get permission to fly into the area in special cases, for example to access the Vatican City Heliport.

The red area in the image above shows prohibited area 243. Marked with blue is the heliport.
There appears to be no restrictions for traffic above 3500 FT. There is even an airway (L5) almost directly above the Vatican City (black line on the map), which has a lower limit of FL95 (9500 FT) - which is a completely normal lower limit of an airway, Vatican City or not - so it seems IFR traffic will routinely fly directly above, albeit not a low levels.