KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration

Description

The plugin does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.