I just noticed a security weakness in mantis.

If

• you have a normal session open in a mantis bug tracker, and
• you are an administrator, and
• you want to access the administrative area, and
• you have not accessed the administrative area in a while,
  then you are presented with a login form for a new secure session.

However, changing your password does not require your old password. Thus, with an open session, without knowing the old password, and without an open secure session, it is possible to open a secure session simply by changing the user password, and then using this new password to open the secure session and access the administrative area.

I suspect this might be used, if an attacker manages to take over a normal session (maybe just by sitting at his computer while he is away) of an administrator, to access the administrative area, even though the extra login was there to prevent this!