diff --git a/controllers/authController.js b/controllers/authController.js
index cd78730..97e0454 100644
--- a/controllers/authController.js
+++ b/controllers/authController.js
@@ -8,14 +8,14 @@ const config = require("../config/config.json");
 // @route           POST /api/v1/auth/register
 // @access          Public
 exports.register = asyncHandler(async (req, res, next) => {
-  const { name, email, password, role } = req.body;
+  const { name, email, password } = req.body;
 
   // Create user ************************************************
+  // Public registration strictly defaults role to "user" to prevent privilege escalation
   const user = await User.create({
     name,
     email,
     password,
-    role,
   });
 
   // Create token ***********************************************
diff --git a/tests/auth.test.js b/tests/auth.test.js
index 557cd7e..30a0f26 100644
--- a/tests/auth.test.js
+++ b/tests/auth.test.js
@@ -26,12 +26,34 @@ describe("Auth Routes", () => {
     await connectDB();
   });
 
+  const publisherEmail = `testpublisher_${Date.now()}@example.com`;
+
   afterAll(async () => {
     // Cleanup
     await User.deleteOne({ email: testUser.email });
+    await User.deleteOne({ email: publisherEmail });
     await mongoose.connection.close();
   });
 
+  it("should ignore requested role on public registration and default to 'user'", async () => {
+    await getCsrfToken();
+    const res = await request(app)
+      .post("/api/v1/auth/register")
+      .set("x-csrf-token", csrfToken)
+      .set("Cookie", cookies)
+      .send({
+        name: "Test Publisher",
+        email: publisherEmail,
+        password: "password123",
+        role: "publisher",
+      });
+    expect(res.statusCode).toEqual(200);
+
+    const createdUser = await User.findOne({ email: publisherEmail });
+    expect(createdUser).not.toBeNull();
+    expect(createdUser.role).toEqual("user");
+  });
+
   it("should register a new user", async () => {
     await getCsrfToken();
     const res = await request(app)