A flaw in a feature that allows users to upload contact details could have revealed phone numbers.