Facebook Stories flaw highlighted by Welsh student Jack Jenkins
Facebook had to disable a messaging feature after a Welsh student revealed he could access strangers' messages.
Aberystwyth University student Jack Jenkins was able to read and delete messages sent through Facebook Stories, which is separate to the main Facebook.
The New Year's Midnight Delivery feature on Stories lets users write messages to friends to be automatically sent after midnight.
Facebook says the feature is now back up and running.
Mr Jenkins found that by making changes to the web address after sending a message, he could read and delete other users' messages.
He blogged: "I just wanted to share this. I don't know how a site like Facebook can continue to take these kinds of risks.
"Please don't go deleting random messages, but try and delete one of mine that I set up especially if you want."
A Facebook spokesperson said the Stories site was taken offline for a time while the issue was dealt with but is now working again.
The messaging service on the main Facebook site has not been affected.