Facebook has since posted an update in which they acknowledge the flaw and shared details about their findings. “The bug also impacted photos that people uploaded to Facebook but chose not to post. For example, if someone uploads a photo to Facebook but doesn’t finish posting it – maybe because they’ve lost reception or walked into a meeting – we store a copy of that photo for three days so the person has it when they come back to the app to complete their post.”
According to Facebook, they estimate that this could have affected as many as 6.8 million users and also up to 1,500 apps built by 876 developers. “We’re sorry this happened. Early next week we will be rolling out tools for app developers that will allow them to determine which people using their app might be impacted by this bug. We will be working with those developers to delete the photos from impacted users.”
The company also states that they will be notifying users who might have been potentially affected by the bug and help them see if they might have used any apps that were affected by it.