Issues with Security Roles

We've just upgraded from August 2018 to January 2019 Report Server.

In the older version anyone with a "Publisher" role was able to publish a PBIX and create Folders and these new objects inherited security. A "Publisher" could not assign Security Roles.

It appears that the Jan 2019 version has broken this logic and now someone with either "Publisher" or "Content Manager" role can assign security.

This is a serious issue.

It is also possible for a "Content Manager" to assign "Content Manager" permissions so security could quickly become an issue.

Thanks