Steps to reproduce the issue

With 3.8.13 the JSST implemented an ACL check to make sure only logged-in people can activate the accounts. In that process we found out that in order to get the admin account mail you just have to have the permission core.create and enabled "System Mails" in the user profile.

https://github.com/joomla/joomla-cms/blob/staging/components/com_users/models/registration.php#L139-L177

While in theorie this sounds good we have a loop hole here:

As authors (or possible any other group that get core.create as global permission) have the global core.create permission he can get that the activation mail and also activate accounts. In oder to create accounts from the backend you are required to have core.manage for com_users too, which the users does not have.

Proposal

The proposal would be an core.activate permission which would result into may places where similar things happen we need to create similar new permissions. I'm not sure what is the correct place or if we should accept the current behavior