The vulnerability description explicitly implicates user_save as the entry point for improper role assignment. The advisory states that when custom/contributed code calls user_save with an explicit category parameter and loads all roles into the array (e.g., via $edit['roles']), it bypasses normal access controls. This matches the behavior of user_save's role handling in vulnerable Drupal versions, where the function would accept the roles array without proper validation when invoked with specific parameters. The function's presence in the User module's user.module file is consistent across Drupal 6.x/7.x architectures.