User admin case: user can escalate permissions beyond a predetermined set

In a use case where a user group exists with permission to only create/edit user and assign them to groups, the addition of the userroles in 14 leads to a security issue.

Users of that "useradmin" group can assign userroles directly to themselves or to other users, thereby bypassing the predetermined set of permissions on group level.

See

Possible solution
Hide or disable the userrole dropdown in the user admin screen, by configuration.