An information disclosure issue exists in the '/api/v1/teams' endpoint. Unauthenticated attackers can use paginated GET requests to retrieve non-public team custom field values, such as emails, phone numbers, and student IDs, provided that team mode and public visibility are enabled.