Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

Summary When you share a project with a team, the API lets you attach any team on the instance, including teams you have nothing to do with, as long as you're an admin of the project. Listing a project's teams then returns each team's full member roster. So any logged-in user can spin up a...