Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.
phpbb phpbb 3.2.7