CVE-2026-58431: Incorrect Authorization

Public-only API token restriction is not enforced on team API routes...