Facebook has temporarily disabled its New Year's Eve messaging tool after a university student was able to read and delete private messages intended for other users.
Jack Jenkins, a business IT student at Aberystwyth university, alerted Facebook to the privacy flaw after finding that a small tweak to a web address allowed him to view messages and photos sent by strangers using the new tool.
Facebook launched its Midnight Message Delivery app as a way for users to send New Year's Eve messages on the stroke of midnight on 31 December.
Jenkins wrote on his blog how he was shocked when he was able to view a personal New Year's message and private family photo sent by a stranger to another named Facebook user.
He wrote: "I just wanted to share this. I don't know how a site like Facebook can continue to take these kinds of risks. PLEASE Don't go deleting random messages, but try and delete one of mine that I set up especially if you want."
Jenkins said he discovered the vulnerabilty by tweaking the URL of a confirmation page on the Facebook app.
He told the Guardian: "I was very surprised to find that this had been overlooked by Facebook, as it's such a simple security hole.
"I was even more surprised to find I could see photos and delete this New Year wish. It seems that Facebook treated all these messages as unique messages, but then failed to link them to a unique person to make them private to them. I don't know all the ins and outs of it, but it's a pretty big thing for a company to overlook."
Facebook immediately disabled the feature after Jenkins published his blogpost.
It is understood that no messages sent on the Facebook website itself were viewable as the Midnight Message Delivery app existed on a separate Facebook Stories site.
A Facebook spokesman said: "We are working on a fix for this issue now, and in the interim we have disabled this app on the Facebook Stories site to ensure that no messages can be accessed."
The blunder comes at an inopportune time for Facebook, just days after founder Mark Zuckerberg's sister complained that her own privacy had been invaded when a private family photo was shared widely by a US journalist.
The picture – of Randi Zuckerberg's family's reaction to Facebook's new Poke app – popped up in the news feed of Callie Schweitzer of Vox Media who assumed it was public and reposted it on Twitter, where it was picked up by several prominent technology blogs.
To contact the MediaGuardian news desk email editor@mediatheguardian.com or phone 020 3353 3857. For all other inquiries please call the main Guardian switchboard on 020 3353 2000. If you are writing a comment for publication, please mark clearly "for publication".
