this is very inconsistent:

if a user is not assigned to some project, he still can execute "update issue" requests through REST API (I'm using Redmine Java API for that) and change fields like "summary", but the server silently ignores "status ID" field in this case.

once you assign the user to be "developer" in the project, he can update the "issue status" field as well.

REST API should NOT silently ignore some fields and allow others to be changed.
need to add a proper message to the response explaining why some fields could not be changed.