The bug allowed roughly 1,500 apps that had been given permission to access users' photos to also see pictures they never shared on their timelines. This includes images shared in Marketplace and Facebook Stories, as well as photos users began to upload but ultimately 'chose not to post'.
Facebook said the bug was active for 12 days, between September 13th to September 25th, before it was discovered and fixed. Facebook has been working with developers to delete the photos from impacted users.
