Summary: A flaw in Facebook allows users to access private photos that are hidden from view, through no less than the social network's own image reporting tool. 
 
 Update: Facebook acknowledges the flaw, and fixes the bug. 
 
 'Report abuse' features in Facebook give users access to personal, private and hidden photos that would normally be hidden from view. 
 
 The flaw, spotted by members of a body building forum, no less, allows Facebook users to access photos revealed by the report abuse tool. 
 
 Only a handful of images are presented to the user as part of the 'report' feature, which is used by Facebook to maintain decency and remove harmful images, posts or content. 
 
 Here's how it works: 
 
 Users are able to report "inappropriate profile photos" on a user's profile. By checking the box "nudity or pornography," the user is granted an opportunity to help Facebook "take action by selecting additional photos to include with your report." Facebook will then display a number of additional photos that are not otherwise publicly available to the user. 
 
 Photos (such as the one below) were taken directly from Mark Zuckerberg's private photo collection on his profile and posted. Ed note: We debated the photo selection and whether to run one at all. We initially posted the Obama-Zuckerberg and then went with a dinner party. We flipped back to the picture with the most public figures. Ultimately, we decided running the picture made sense. 
 
 (Source: "Mark Zuckerberg", Facebook) 
 
 This flaw appears to expose private photos of any person on Facebook. We tried this out for ourselves: Sometimes, private photos were exposed; others times they weren't. 
 
 Members of the forum also posted onto an image sharing website some of of Zuckerberg's private Facebook photos, which are normally inaccessible from public viewing. 
 
 The forum explored a number of the flaw's details. For example, private photos that are hidden or inaccessible to people who are friends, can not only be accessed but can be enlarged to their full scale. 
 
 Some browsers restrict this flaw. 
 
 One thing to note: Exploiting this flaw requires reporting a Facebook member. 
 
 But this flaw is open for anyone to use -- and abuse. While Facebook anonymises the data that it gets through this reporting tool, the user whose profile pictures can be viewed will not know that their privacy has been invaded. 
 
 Update: Facebook issued this statement a short time ago: 
 
 "Earlier today, we discovered a bug in one of our reporting flows that allows people to report multiple instances of inappropriate content simultaneously. 
 
 The bug, was a result of one of our most recent code pushes and was live for a limited period of time. Not all content was accessible, rather a small number of one's photos. Upon discovering the bug, we immediately disabled the system, and will only return functionality once we can confirm the bug has been fixed." 
 
 Facebook added that the privacy of our user's data is a top priority for the company, and Facebook invests lots of resources in protecting our site and the people who use it. 
 
 Related: ||||| A Facebook security hole that allows you to view, save and share private photos has enabled one hacker to expose those of Mark Zuckerberg. 
 
 The method requires you to first locate the person you want to view photos of, then report a photo as nudity or pornography. From there, check Report to Facebook and click continue. Facebook will then give you the option to help them take action by selecting additional photos to include in the report, which then gives you access to the user's private photos. 
 
 Facebook has received an enormous amount of criticism lately for its privacy practices . In November, Facebook settled with the Federal Trade Commission over its failure to keep its privacy promises and Zuckerberg admitted that Facebook "made a bunch of mistakes." 
 
 "With each new tool, we've added new privacy controls to ensure that you continue to have complete control over who sees everything you share," Zuckerberg wrote to Facebook users in November. "Because of these tools and controls, most people share many more things today than they did a few years ago." 
 
 Now with everyday users able to access private photos, it brings up the question of, once again, how safe is it to upload your information and photos to Facebook, even if you have strict privacy settings enforced? 
 
 "This shows that Facebook has no robust security model at all," raphman, who is a PhD student, writes on Hacker News . "Either they do not have any mandatory access control for private data, or someone approved of circumventing such access control measures for this feature. Both is in my opinion inacceptable for a company holding so much potentially sensitive data." 
 
 As the blog with the images of Zuckerberg states, "It's time to fix those security flaws facebook..." 
 
 With Facebook under watch by the FTC for the next 20 years, we wonder what effect this will have on the social network considering that for every violation, the FTC could charge up to $16K. 
 
 
 
 [UPDATE 12/13/11 at 9:15am: Facebook is now suggesting that you enable secure browsing to help protect account from hackers. ][ UPDATE 11:52am PT: ] Facebook has ackowledged the bug that allowed users to access private photos and is currently fixing the bug. A Facebook spokesperson told ZDnet that the bug "was discovered in one of our reporting flows" that let users report several instances of inappropriate images or posts. Facebook also reaffirmed its commitment to data privacy, stating it as a "top priority" for the company. ]
– A temporary glitch allowed Facebook users to view others' private photos with a surprisingly easy trick, reports ZDNet. It's been fixed, but not before some of Mark Zuckerberg's own private photos got pilfered and reposted on blogs, like here at Launch. The trick: You could report an image to Facebook as inappropriate and mark the "nudity or pornography" box (even if it wasn't). At that point, Facebook would give you access to other photos in the user's private stream so you could check for more to flag. Facebook announced this afternoon that it fixed the problem, notes Gizmodo. "Earlier today, we discovered a bug in one of our reporting flows that allows people to report multiple instances of inappropriate content simultaneously," it said, calling the glitch "the result of one of our recent code pushes." The system has been disabled.