Fossil[0] has bug tracking as a standard feature, and through the HTTP role-based authentication, you are able to set up users with different privileges; for instance, being able to read and write the bug tracker without the ability to push new code.

[0]: https://fossil-scm.org/home/doc/trunk/www/index.wiki