The issue allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting. This occurs because MantisBT does not use an expected default value during decisions about whether a user may modify the status of a bug.