It was reported that turba does not properly check permissions on address books, allowing users to modify addresses in other users' address books. This problem affects both shared and non-shared address books. Knowing (or guessing) the objectid seems to be sufficient to allow modification of other users' addresses.

More information can be found in Debian bug report, which also contains some proposed patches: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058

Upstream bug report: http://bugs.horde.org/ticket/?id=6208