Members of a team in org can view detail of other teams (in the same org) via api

[rucciva]

• Gitea version (or commit ref): 1.8.0
• Git version: 2.20.1
• Operating system: linux
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes ( https://rucciva-peasant:mC2yjUj5K5gcFPP@try.gitea.io/api/v1/teams/2633/members)
  • No
  • Not relevant
• Log gist:

Description

If a user is added to a team in organization, the user could obtains information on other teams in the same organization via api (GET /teams/{id} and GET /teams/{id}/*). Meanwhile, accessing other team's page via web ui is forbidden

Screenshots