An issue exists where authenticated users can manipulate the read-only `external id` field via the team create and update endpoints. This mass assignment allows attackers to mark a team they create or manage as externally managed, which prevents the removal of team members and causes users authenticated via Single Sign-On (SSO) to be removed from the team during their next login.