A now-patched Instagram vulnerability allowed attackers to access private photos and captions on some accounts without logging in or following users.