Team data disclosure via unchecked API object reference

Authorization bypass in Octopus Deploy Octopus Server 2022.1, 2022.2, and 2022.3 allows remote authenticated users to read team data via the API. The API accepts a user-controlled team object reference without checking whether the requester has permission for that team, then returns its members, description, and permissions. An authenticated account lacking access to the requested team is sufficient; the disclosed data is limited to team membership, description, and assigned permissions.