CVE-2026-34390: MantisBT Vulnerable to Privilege Escalation from Manager to Administrator

Insufficient access control checks in ProjectUsersAddCommand (used in manage_proj_user_add.php and REST API endpoint PUT /project/{id}/users) allows users having manage_project_threshold access level (manager by default) to grant project-level administrator access to any user (including themselves) in any Project they have manager rights in.

The normal project-user add form does restrict the selectable access levels to the actor’s own project role or below. However, the backend handler still accepts a forged higher access_level value and writes it.