Did you read 0022844, and the FAQ in the admin guide about this error ?

I did. This is my current configuration:

./.htaccess (in Mantis root):

./config/config_inc.php:

<?php
$g_hostname               = 'localhost';
$g_db_type                   = 'mysqli';
$g_database_name          = 'xxxxxxx';
$g_db_username            = 'xxxxxxx';
$g_db_password            = 'xxxxxxx';

$g_default_timezone       = 'Europe/Berlin';

$g_crypto_master_salt     = 'xxxxxxx=';

$g_path                   = 'http://xxxx.com/mantis/';
$g_form_security_validation = ON;
$g_display_errors = array(
    E_WARNING => 'halt',
    E_NOTICE => 'halt',
    E_USER_ERROR => 'halt',
    E_USER_WARNING => 'halt',
    E_USER_NOTICE => 'halt'
);
$g_show_detailed_errors = ON;

=> Changing $g_form_security_validation = ON; to $g_form_security_validation = OFF; worked but is a serious security issue, so no proper solution.

The debugging shows:

APPLICATION ERROR 2800

Ungültiges Sicherheitstoken zum Formular. Dies kann durch einen Sitzungsablauf oder durch versehentliches doppeltes Speichern des Formulars verursacht worden sein.

Bitte benutzen Sie die „Zurück“-Taste Ihres Browsers, um auf die vorhergehende Seite zurückzukehren. Dort können Sie den hier angezeigten Eintrag korrigieren oder eine andere Aktion ausführen. Über das Menü können Sie auch direkt zu einer anderen Aktion wechseln.
Detailed error information

Full path: /www/htdocs/xxxxx/mantis/core/form_api.php
Line number: 157
Stack trace
#   Filename    Line    Class   Type    Function    Args
0   /www/htdocs/xxxxx/mantis/core/form_api.php  157 -   -   trigger_error   <string>'2800', <integer>256
1   /www/htdocs/xxxxx/mantis/manage_proj_create.php 54  -   -   form_security_validate  <string>'manage_proj_create'

It seems that it works with an HTTPS connection though, even when $g_form_security_validation = ON; is set. Can you confirm this as proper solution?

Changing [...] to $g_form_security_validation = OFF; worked but is a serious security issue, so no proper solution.

Indeed, not recommended to switch this off.

It seems that it works with an HTTPS connection though, even when $g_form_security_validation = ON; is set.

That would rule out a problem with MantisBT code, and indicate the issue is with your server's configuration.

Can you confirm this as proper solution?

It is best practice to operate on a secure connection, so if it works like that then I think you're all set.