Administrator account creation via unfiltered invite fields

Mass assignment in AnythingLLM before 1.0.0 allows remote attackers with a valid invitation link to create an administrator account. The /api/invite/:code handler passes the entire request body to User.create, so an injected role property overrides the intended default privilege. Possession of a pending invitation code is required; successful exploitation creates an administrator able to perform privileged application actions.