https://www.ibm.com/support/pages/apar/PI31157
PI31157: USERS WITH ONLY THE 'MANAGE USERS' ACTION AND NOT 'SECURITY ADMIN' CAN NO LONGER CREATE...
Your application leads role users will no longer be able to create users or manage security. You will see: