“We’re sorry this happened,” Tomer Bar, engineering director at Facebook, wrote in a blog post about the flaw.

The flaw allowed apps that users accessed through the social network’s “Facebook Login” system to see photos that had been uploaded but not published on Facebook, as well as photos published to Facebook’s “Marketplace” and to its Stories feature.

“The bug also impacted photos that people uploaded to Facebook but chose not to post,” Bar wrote.