Administrator access via trusted registration role

Improper privilege management in Tourism Management System allows remote attackers to create administrator accounts through registration. The unauthenticated /users/register handler binds the entire UsersEntity request body and inserts it without replacing or rejecting the attacker-controlled role field. An internet- or intranet-reachable registration endpoint is sufficient, and the resulting account receives privileges carried into its login token.