Bitdefender
Resource Center

 The Financial Times already reported on the important privacy issue regarding the reshare feature that cannot be disabled by default, and this related flaw presents similar problems.

One of the main features of Google+ is Circles, the possibility to easily share the right content to the right people. However, once the content has been shared to a Circle, anyone can share it by default to other Circles. It boils down to the fact that the tagging feature can be bypassed by using the reshare option. Let's say user “A” shares a picture only to their “Close Friends” circle, and disables resharing. All it takes is for someone from that "Close friend" circle to tag a person from outside this circle in the picture. Once this has been done, that person can share the picture to anyone, in any way.

Whilst it's true that once someone has access to a picture they can save it and redistribute it, the concern here is that Google+ is promoting Circles as a way to be selective about how you share content, yet accidental and even deliberate sharing to other Circles is all too easy to do. Let’s not forget, if it happened to Bono, it can happen to anyone.

UPDATE:

Acording to ZDNET, "As pointed out in the comments, it looks like a partial fix is now available, as a drop-down menu has been enabled for users to disable resharing after a post has already been made." We have tested again, and seems like the resharing disabled feature is working. However, the problem remains that tagging is not fully connected to sharing rights. So, if someone tags users that do not have the right to see a photo, they are still able to do so. 

UPDATE nr. 2:

Let’s explain the process here in a little more detail(with the current status of the issue):

1.  George shares  a photo with his friend Tim, and disables the resharing option(pic1, bottom image)

2.  Tim tags a third person, David, in the photo - the post is automatically cloned with different sharing settings

3.  This means that the photo will be automatically cloned in a post  that can be shared (pic2) with whoever he wants.