Previously reported in https://tracker.phpbb.com/browse/SECURITY-179

m_report already implies f_read for reported posts, but such reports are only accessible if the forum_id is removed from the URL.