When user creation was in error, user management threshold was set from admin page to MANAGER:

image.png (86,920 bytes)   

image.png (86,920 bytes)   

I have no time at the moment to try myself.
Just a guess: You might have multiple entries of manage_user_threshold in your configuration (maybe for some specific projects)

There are no other entries of manager_user_threshold. Actually, this problem occured on a fresh install of MantisBT 2.25.2 with 2 projects and 4 users and almost no customization by project.

The fix is not a priority as the file configuration seems to be a valid workaround.

Regression introduced in version 2.11.0 0023838

The access denied is triggered because the user creation command checks access at global level. This is necessary, because users are a global entity; allowing their creation based on access rights at project level is likely to introduce a security hole.

Without this restriction, a user A with a global access level of REPORTER but MANAGER in a specific project would be able to create a new user B with a global access level of MANAGER. User B could therefore be granted access to other projects, where A would normally only have a REPORTER access.

Regression introduced in version 2.11.0 0023838

@atrol this is not a regression from the issue you referenced.

The access_ensure_global_level() check against manage_user_threshold was already present before the introduction of UserCreateCommand (0023837), in fact that check has been there since MantisBT master 831e4368 (0.18.0a1).

Now arguably, the user management page should not provide the user creation button in that case. And we should probably check to make sure that there is no other loophole (e.g. when editing user).

@dregad did you try the original post?

When trying with a user with global level MANAGER and having set manage_user_threshold in database to value 70, creating a user works as expected in version 2.10.0.
Starting from version 2.11.0, it does not work any longer.
It still works, if manage_user_threshold is set just in config_inc.php but not database to 70.

PR https://github.com/mantisbt/mantisbt/pull/1803

did you try the original post?
When trying with a user with global level MANAGER [...]

Yes I did. The original post does not actually mention global access level, so I was concerned about a potential security loophole.

I just tested that scenario (i.e. reporter user with manager access in a single, specific project) and confirmed that in this case there is no access to global user management features, so everything is fine. I'll approve the PR.

PR for master-2.25 https://github.com/mantisbt/mantisbt/pull/1804