Facebook has informed its developers of "a photo API bug" that allowed third-party apps to access photos uploaded to the social media's servers, regardless of whether the user then chose to share these images on their timelines or not. The company has admitted that this new flaw had been in effect for eight days in September 2018 and may have affected as many as 6.8 million users who logged in on those dates.
https://www.notebookcheck.net/Facebook-discloses-info-on-bug-that-allowed-apps-access-to-6-8-million-users-non-posted-photos.380966.0.html