Yeah, after it's been fixed the person who discovered it is welcome to post details about what it would allow an attacker to do / see / etc.
Eg - up until today, and for who knows how long, photos you thought were private may have been accessed by undesireables.