Who can see it? Anyone who has a project access level equal to or greater than that set by $g_private_bug_threshold (default is DEVELOPER).
There are no restrictions on what can be done with it (except for the obvious restriction that it can only be done by someone with high enough access).