i just looking in the source. i mentation that the securty checks looks like:

if( !mci_has_readonly_access( $t_user_id, $t_project_id ) ) {
return mci_soap_fault_access_denied( $t_user_id );
}

in the mc_issue_get() in mc_issue_api.php

this use the: user_get_access_level( )
in mc_api.php:65

this use the: project_get_local_user_access_level()
in user_api.php:839

if you look to the documentation you can read:

Return the user's local (overridden) access level on the project or false

if the user is not listed on the project

to priject_api.php:452

If the user is not related to the project the method always return false and the global access level will compare, the problem of private projects will never asked.

The only way is to fix this, use the internal access_api of mantis. So the fix is:

if( !access_has_bug_level( VIEWER, $p_issue_id, $t_user_id ) ){
return mci_soap_fault_access_denied( $t_user_id );
}