The company said in a blog that the problem has been fixed but that it may have affected up to 1,500 apps built by 876 developers.
Facebook said some third-party apps may have gained access to broader set of photos than usual for 12 days between September 13 to September 25.
The bug is the latest in a string of privacy problems the tech giant disclosed this year, including the massive Cambridge Analytica data scandal in April and a data breach of nearly 30 million accounts in October.
Facebook shares were down 1.3 percent at $143.07 in early trading on Friday. The Nasdaq composite index fell 0.9 percent.