Facebook has discovered a bug that gave third-party apps access to the photos of up to seven million users.
The glitch was active for 12 days between 13 and 25 September.
It was found in software that used Facebook logins to give third-party apps permission to access users' images.
The social media giant said the bug meant access was granted to a broader set of photos than intended, including ones uploaded to the site but never posted.
They added that up to 6.8 million accounts were exposed.
Facebook's engineering director Tomer Bar said: "When someone gives permission for an app to access their photos on Facebook, we usually only grant the app access to photos people share on their timeline.
"In this case, the bug potentially gave developers access to other photos, such as those shared on Marketplace or Facebook Stories.
"The bug also impacted photos that people uploaded to Facebook but chose not to post.
"For example, if someone uploads a photo to Facebook but doesn't finish posting it – maybe because they've lost reception or walked into a meeting – we store a copy of that photo so the person has it when they come back to the app to complete their post."
The tech firm said the bug affected up to 1,500 apps built by 876 developers.
Mr Bar continued: "We're sorry this happened.
"Early next week we will be rolling out tools for app developers that will allow them to determine which people using their app might be impacted by this bug.
"We will be working with those developers to delete the photos from impacted users.
"We will also notify the people potentially impacted by this bug via an alert on Facebook.
"The notification will direct them to a Help Centre link where they'll be able to see if they've used any apps that were affected by the bug."
More from Facebook
The social network recommended that users log into any apps which they have previously given access to their photos to check which images the app has access to.
The incident is the latest in a series of data breaches to hit the social network this year, following the Cambridge Analytica scandal and another leak in September which affected around 29 million users.
Facebook has discovered a bug that gave third-party apps access to the photos of up to seven million users.
The glitch was active for 12 days between 13 and 25 September.
It was found in software that used Facebook logins to give third-party apps permission to access users' images.
The social media giant said the bug meant access was granted to a broader set of photos than intended, including ones uploaded to the site but never posted.
They added that up to 6.8 million accounts were exposed.
Facebook's engineering director Tomer Bar said: "When someone gives permission for an app to access their photos on Facebook, we usually only grant the app access to photos people share on their timeline.
"In this case, the bug potentially gave developers access to other photos, such as those shared on Marketplace or Facebook Stories.
"The bug also impacted photos that people uploaded to Facebook but chose not to post.
"For example, if someone uploads a photo to Facebook but doesn't finish posting it – maybe because they've lost reception or walked into a meeting – we store a copy of that photo so the person has it when they come back to the app to complete their post."
The tech firm said the bug affected up to 1,500 apps built by 876 developers.
Mr Bar continued: "We're sorry this happened.
"Early next week we will be rolling out tools for app developers that will allow them to determine which people using their app might be impacted by this bug.
"We will be working with those developers to delete the photos from impacted users.
"We will also notify the people potentially impacted by this bug via an alert on Facebook.
"The notification will direct them to a Help Centre link where they'll be able to see if they've used any apps that were affected by the bug."
More from Facebook
The social network recommended that users log into any apps which they have previously given access to their photos to check which images the app has access to.
The incident is the latest in a series of data breaches to hit the social network this year, following the Cambridge Analytica scandal and another leak in September which affected around 29 million users.
