In phpBB/includes/mcp/mcp_queue.php, the disapprove_posts() method iterates over $post_info and computes whether an entire topic is being disapproved using the variable $topic_id. However, $topic_id is never defined within disapprove_posts(). It's only a parameter/var in the main() listing logic, not in this static method.

As a result, $topic_information[$topic_id] and $topic_posts_unapproved[$topic_id] are accessed with a null key. Since null == 0 evaluates to true in PHP, $disapprove_all_posts_in_topic becomes true for every post.
Impact:

• The topic_in_queue notification is incorrectly removed for every disapproved post.
• The wrong notification type is sent (disapprove_topic instead of disapprove_post, and vice versa).
• PHP warnings are emitted for undefined array keys.
•  

The topic key should be taken from the handled element, i.e. $post_data['topic_id'], so the "disapprove whole topic" logic operates on the correct topic.