After further investigation:
In a standard installation of Strapi, the “User & Permission”-Plugin is now activated from the start on.
So a simple post to the endpoint /users will have the role field as mandatory. But with that plugin you shouldn’t trigger the endpoint directly.
Instead trigger the url /auth/local/register for SignUp and /auth/local for SignIn.