Any users with access level "Manager" can grant any users to access level "Administrator" in any projects they have Manager access to, due to missing validation for the user provided input access_level. This allows an attacker with access level "Manager" to escalate the access level to "Administrator", and perform "Administrator" only actions in different projects.

Affected endpoints are:

1. PUT /api/rest/projects/<project_id>/users/
2. POST /manage_proj_user_add.php

=========================================================
In the front-end, manager users are not supposed to be able to grant any users to access level "Administrator". Therefore, it is assumed that manager users should only grant users access level up to "Manager": @see attachment (Pasted image 20260323153001.png)

In the back-end, although method validate in class ProjectUsersAddCommand did validate current user's access level must be greater than manage_project_threshold and project_user_threshold (70), it did not validate the user-controlled access_level value also need to be less than current user's access level.

Vulnerable Code Fragment:
mantisbt/core/commands/ProjectUsersAddCommand.php line 99 - 120:

class ProjectUsersAddCommand extends Command {
    // [...]
    function validate() {
        // [...]
        $this->access_level = access_parse_array( $t_access_level );
        // [...]
        $t_actor_id = auth_get_current_user_id();
        // [...]
        $t_access_check = access_has_project_level(
            config_get( 'manage_project_threshold', /* default */ null, $t_actor_id, $this->project_id ),
            $this->project_id );

        $t_access_check = $t_access_check &&
            access_has_project_level(
                config_get( 'project_user_threshold', /* default */ null, $t_actor_id, $this->project_id ),
                $this->project_id );

        if( !$t_access_check ) {
            throw new ClientException( "Access Denied", ERROR_ACCESS_DENIED );
        }
    }
}

Patch

We can patch this vulnerability by validating the user-controlled access_level value to be less than current user's access level in below mantisbt/core/commands/ProjectUsersAddCommand.php line 104:

        $t_actor_id = auth_get_current_user_id(); // line 104
        $t_actor_access_level = access_get_global_level( $t_actor_id );
        if ( $t_actor_access_level < $this->access_level ) {
            throw new ClientException( "Access level cannot be higher than your own access level", ERROR_ACCESS_DENIED );
        }