The bug Facebook is telling users about caused the setting to flip to public without notifying the user, so if they rightfully assumed that their privacy settings hadn't changed, they were wrong.
"We recently found a bug that automatically suggested posting publicly when some people were creating their Facebook posts", said Erin Egan, Facebook's chief privacy officer.
"We'd like to apologize for this mistake", Egan said.
Facebook said this affected users posting between May 18 and May 27 as it was implementing a new way to share some items such as photos.
Facebook's admission comes at a testy time for the Menlo Park-based social network, which continues to deal with a stream of privacy-related scandals set off by the revelation this year that political firm Cambridge Analytica had obtained millions of users' personal information without their permission.
CEO Mark Zuckerberg ultimately issued a mea culpa and promised to do better for its users, a promise, in light of the most recent bug, is something the company is going to have to work harder to keep.More news: David Koch to retire from Koch Industries due to poor health - memo
Facebook said it will notify all users who may have been hit by the programming error. The affected users will then be shown which posts were marked public during the glitch. These items are visible to the public, however, the company extended that setting to all the new posts, TechCrunch reports. Facebook will soon start individually informing the people who were affected by the bug. And while the bug was only in effect for a few days, it's an example of how many different settings users have to be aware of on Facebook.
Affected Facebook users received a notification on the app or website starting Thursday.
Facebook, which said it discovered the bug, has not yet shared details about who may have accessed the exposed data, or how that access may have occurred.
It was unclear if users could have done anything to their settings to prevent being affected by the bug the company revealed on Thursday.