Unauthenticated privilege escalation via trusted role parameter

Improper privilege management in SourceCodester College Notes Gallery Management System 1.0 allows remote attackers to create privileged accounts. signup.php copies the client-supplied role parameter directly into the users table without server-side validation or an allowlist. No prior account is required because the public registration form reaches the insert, and the assigned role governs access to privileged application functions.