A "missing request validation" error in phpBB 2 before 2.0.18 allows remote attackers to edit private messages of other users, probably by modifying certain parameters or other inputs.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2005-3536
http://www.securityfocus.com/bid/15246