Index: tests/phpunit/tests/rest-api/rest-users-controller.php
===================================================================
--- tests/phpunit/tests/rest-api/rest-users-controller.php	(revision 39366)
+++ tests/phpunit/tests/rest-api/rest-users-controller.php	(working copy)
@@ -953,6 +953,45 @@
 		$this->assertTrue( $user_is_member );
 	}
 
+	/**
+	 * @ticket 38961
+	 */
+	public function test_user_with_promote_users_can_add_user_to_site() {
+		if ( ! is_multisite() ) {
+			$this->markTestSkipped( 'Test requires multisite.' );
+		}
+
+		$user_id = self::factory()->user->create( array( 'role' => 'subscriber' ) );
+
+		$user_id_promoter = self::factory()->user->create( array(
+			'role'       => 'subscriber',
+			'user_login' => 'promote_users',
+		) );
+
+		$user_promoter = new WP_User( $user_id_promoter );
+		$user_promoter->add_cap( 'list_users' );
+		$user_promoter->add_cap( 'promote_users' );
+
+		wp_set_current_user( $user_id_promoter );
+
+		switch_to_blog( self::$site );
+
+		$request = new WP_REST_Request( 'PUT', '/wp/v2/users/' . $user_id );
+		$request->add_header( 'content-type', 'application/x-www-form-urlencoded' );
+		$request->set_body_params( array(
+			'roles' => array( 'editor' ),
+		) );
+		$this->server->dispatch( $request ); // This is rest_cannot_edit
+
+		restore_current_blog();
+
+		$user_is_member = is_user_member_of_blog( $user_id, self::$site );
+
+		wpmu_delete_user( $user_id );
+
+		$this->assertTrue( $user_is_member );
+	}
+
 	public function test_json_create_user() {
 		$this->allow_user_to_manage_multisite();
 		wp_set_current_user( self::$user );