Facebook discovers a new privacy flaw that lets some app developers access restricted data in Groups.