I don't understand the problem at the moment.
Is there a reason (e.g. security) that you set Severity to major?

There is a difference between anonymous visiting the bugtracker (web crawlers, users just viewing, ...) and beeing logged in as anonymous user.
e.g. you will also notice that the current selected project is stored if you are logged in.

We would not need the "Login Anonymously" link if there is no difference.

As a side note: We don't recommend to use another access level than VIEWER for the anonymous account.
http://www.mantisbt.org/docs/master/en-US/Admin_Guide/html-single/#admin.config.misc

We would not need the "Login Anonymously" link if there is no difference.

In this case user should not be detected as 'anonymous' if he did not login as 'anonymous'

I believe the root cause for this is that when a page is browsed anonymously without prior login, the anonymous user's cookies are not actually set. This causes MantisBT API functions such as config_get() to return a generic value.

In this case, it returns whatever value is defined for $g_report_bug_threshold in config file instead of what might be defined in the database (global or project-specific).

PR https://github.com/mantisbt/mantisbt/pull/623

EDIT: for the record, removed the "git trunk" product version as the issue likely exists since a very long time.

Reducing severity to minor since this is a corner case and we likely had this bug for a long time.

EDIT: please ignore me - I posted this note in the wrong issue...