diff --git a/api_views/users.py b/api_views/users.py
index 172540a..ea21e40 100644
--- a/api_views/users.py
+++ b/api_views/users.py
@@ -57,16 +57,11 @@ def register_user():
         try:
             # validate the data are in the correct form
             jsonschema.validate(request_data, register_user_schema)
-            if vuln and 'admin' in request_data:  # User is possible to define if she/he wants to be an admin !!
-                if request_data['admin']:
-                    admin = True
-                else:
-                    admin = False
-                user = User(username=request_data['username'], password=request_data['password'],
-                            email=request_data['email'], admin=admin)
-            else:
-                user = User(username=request_data['username'], password=request_data['password'],
-                            email=request_data['email'])
+            # Privilege level is never taken from client input: newly self-registered
+            # accounts are always created as non-admin, no matter what extra fields
+            # (e.g. "admin") the caller stuffs into the request body.
+            user = User(username=request_data['username'], password=request_data['password'],
+                        email=request_data['email'])
             db.session.add(user)
             db.session.commit()