On 4th of December of 2018, Facebook announced that up to 1,500 apps created by 876 developers had unrestricted access to the user’s profile images, including unpublished photos and photos set to private. The application program interface (API) bug affected users from September the 13th to September 25th of 2018 and regards the applications which asked access to the profile images.
Facebook users who granted access to third-party apps from the fifteen thousand apps which had the problem, gave unhindered access to their profile images, whether public or private.
Affected users are being identified and notified by the company. Users can also access the following dedicated page to see if they’re affected: https://www.facebook.com/help/200632800873098
Tomer Bar, a Facebook developer, explained the Photo API bug:
“When someone gives permission for an app to access their photos on Facebook, we usually only grant the app access to photos people share on their timeline. In this case, the bug potentially gave developers access to other photos, such as those shared on Marketplace or Facebook Stories. The bug also impacted photos that people uploaded to Facebook but chose not to post. For example, if someone uploads a photo to Facebook but doesn’t finish posting it – maybe because they’ve lost reception or walked into a meeting – we store a copy of that photo for three days so the person has it when they come back to the app to complete their post.
Currently, we believe this may have affected up to 6.8 million users and up to 1,500 apps built by 876 developers. The only apps affected by this bug were ones that Facebook approved to access the photos API and that individuals had authorized to access their photos.
We’re sorry this happened. Early next week we will be rolling out tools for app developers that will allow them to determine which people using their app might be impacted by this bug. We will be working with those developers to delete the photos from impacted users.
We will also notify the people potentially impacted by this bug via an alert on Facebook. The notification will direct them to a Help Center link where they’ll be able to see if they’ve used any apps that were affected by the bug. (See example of user notification below)
We are also recommending people log into any apps with which they have shared their Facebook photos to check which pictures they have access to.”
Facebook users were exposed to this bug for 12 days, but it’s unclear if hackers exploited any vulnerabilities. Also, such API errors are not uncommon among corporations. Earlier this year, Twitter and Google were also affected by similar bugs which exposed the information of over 50 million people.