Techcrunch, a blog, first reported a bug related to a feature on the fast-growing social network site that allows a user to see how their profile will appear to other users.
By manipulating the "preview my profile" feature, Facebook said people were able to view their friends' private chat messages and pending friend requests for a limited amount of time on Wednesday.
"We worked quickly to resolve this matter, ensuring that once the bug was reported to us, a solution was quickly found and implemented," a Facebook spokeswoman said in an emailed statement.
Marc Rotenberg, executive director of the Electronic Privacy Information Center, said Facebook's privacy slip-up underscores the need for greater scrutiny of the company.
"Our view is that the FTC (U.S. Federal Trade Commission) needs to act on consumer concerns about Facebook's sloppy privacy and security practices," Rotenberg said.
Facebook's instant messaging service was disabled while engineers fixed the bug. The problem was resolved by Wednesday afternoon, Facebook said.
The snafu is embarrassing to Facebook, the world's No.1 Internet social network with 400 million users, as it comes under increasing scrutiny from privacy advocates.
Facebook changed the way users' personal profile information is treated last month. It now requires that data about an individual's hometown, education and hobbies be tied to public pages devoted to those topics.
Four U.S. senators wrote to Facebook Chief Executive Mark Zuckerberg last week taking issue with some of the changes.
Social networking services like Facebook and Twitter, in which users share information with friends and other contacts, have become enormously popular.
Internet search giant Google Inc spurred a privacy controversy in February when it launched a new social media service dubbed Buzz.
The service initially used an individual's email contacts from Google Gmail to build a social network of Buzz contacts that the rest of the world could see. Google acted quickly to change the settings so that contacts were kept private by default.