Does this mean that another user who is not an administrator is getting administrator rights? I don't think so.

What is the expected behaviour?

yes.. I just logged as administrator and update reporter user to developer and check his email.. There is link like I mention above, that link gives direct access of my account means administrator's account.that reporter gets all rights from my account till he is not log off. security is not maintend.

If I log off after this update process and after that check email of that reporter its working right.. It is asks for login for reporter to check its updated details.

I think this is expected behavior, as Mantis keeps your session active by means of a cookie. Since you did not log off as administrator after updating the user's profile, that session was still current when you clicked on the link.

Please try to click on the e-mail link on a different PC or using another browser on the same PC. Or, as you have already indicated, just log off as administrator after making the changes.

Resolving due to lack of feedback for over a year