Photos marked “private” were actually visible to others because of a bug in a reporting tool. Facebook has now patched the problem.