Cross-site request forgery (CSRF) vulnerability in index.php in FlatNuke 2.6 and possibly 3 allows remote attackers to change the password and privilege level of arbitrary accounts via the user parameter and modified (1) regpass and (2) level parameters in a none_Login action as demonstrated by using a Flash object to automatically make the request.