My Mantis install has internal and external users :

• Public issues are visible to all users (g_limit_view_unless_threshold left to its default value of ANYBODY)
• Private issues are only visible to internal users + reporter / handler

We have a limited number of external users (a bit more than a hundred) that we all know in real life. For that reason, we often want to include extra users to a private issue if we think they may experience the same problem or know a solution to it.

I expected adding them as monitors would grant them access, but it doesn't. I suggest to change this behavior.

I don't think granting monitors access to private issues would be a security threat, since you can't add yourself as monitor, you would need prior access to the issue to do that.