Playbook disclosure via missing team authorization

Authorization bypass in Mattermost Playbooks 7.5.1 and earlier allows remote authenticated users to read playbooks from other teams. The /plugins/playbooks/api/v0/runs handler returns run and playbook data without checking whether the requester belongs to the owning team. A valid low-privilege account is required; the demonstrated consequence is unauthorized reading, with no reported ability to modify playbooks.