Facebook temporarily disabled its New Year's Eve messaging tool after a university student was able to read and delete private messages intended for other users.
Jack Jenkins, a business IT student at Aberystwyth University in Wales, alerted Facebook to the privacy flaw after finding that a small tweak to a web address allowed him to view messages and photos sent by strangers using the new tool.
Facebook launched its Midnight Message Delivery app as a way for users to send New Year's Eve messages on the stroke of midnight.
Jenkins wrote on his blog how he was shocked when he was able to view a personal New Year's message and private family photo sent by a stranger to another named Facebook user.
Facebook immediately disabled the feature after Jenkins published his blogpost.
It is understood that no messages sent on the Facebook website itself were viewable as the Midnight Message Delivery app existed on a separate Facebook Stories site.
The blunder comes at bad time for Facebook, just days after founder Mark Zuckerberg's sister Randi complained her own privacy had been invaded when a private family photo was shared widely by a US journalist.